That single packet keeps the tunnel up because it resets the lifetime of the SA before it expires. One solution I have used is to configure IP SLA to send a single PING packet through the tunnel every say 10 minutes. Going back to keeping the tunnel up, there's no command (for VPN) to keep a tunnel up as far as I'm aware.Īs long as there's traffic going through the tunnel, the tunnel is going to remain up. Specifies that any interface that has a device name starting with F5 will be set as a VPN interface. VPN Device Names (Windows) This parameter lets you specify a VPN adapter. This parameter applies only to Windows clients. To avoid waiting for that to happen, just enable keepalives to make sure the tunnel is alive all the time. if supported, overriding the language selected at installation time. If not use crypto isakmp keepalives, then the SAs are not going to be torn down unless the lifetime expires or are manually cleared. This is useful when one site loses Internet and tries to restablish the tunnel but can't because the other side ''thinks'' that the tunnel is still up. The command is used to monitor the status of the tunnel and allow a site to torn the tunnel down if not receiving a response from a peer in a defined amount of seconds. Changing the line that stated ForceKeepAlives0 to 1 was supposed to activate the client keep alive. I found a document that stated I could edit the C:Program FilesCisco SystemsVPN ClientprofilesProfileNa me.pcf with wordpad. The crypto isakmp keepalive command is not going to keep the tunnel up. I was also tring to find a way to initate a keep alive from the client side as well.

Checkpoint vpn client keep alive