Cisco 500 Series, Configuration Manual

Page: 704 / 1140

30-88
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 30 Configuring Connection Profiles, Group Policies, and Users
Configuring User Attributes
hostname(config-username)# webvpn
hostname(config-username-webvpn)# svc compression none
hostname(config-username-webvpn)#
Step 3
To enable dead-peer-detection (DPD) on the security appliance and to set the frequency with which
either the SVC or the security appliance performs DPD, use the
svc dpd-interval command. To remove
the svc dpd-interval command from the configuration, use the no form of the command. To disable SVC
DPD for this user, use the none keyword:
hostname(config-username-webvpn)#
svc dpd-interval
{[
gateway
{ seconds |
none
}] | [
client
{ seconds | none }]}
hostname(config-username-webvpn)#
DPD checking is disabled by default.
The gateway refers to the security appliance. You can specify the frequency with which the security
appliance performs the DPD test as a range of from 30 to 3600 seconds (1 hour). Specifying
none
disables the DPD testing that the security appliance performs.
The client refers to the SVC. You can specify the frequency with which the client performs the DPD test
as a range of from 30 to 3600 seconds (1 hour). Specifying
none disables the DPD testing that the client
performs.
In the following example, the user configures the DPD frequency performed by the security appliance
(gateway) to 3000 seconds, and the DPD frequency performed by the client to 1000 seconds for the
existing user named sales:
hostname(config)#
username sales attributes
hostname(config-username)# webvpn
hostname(config-username-webvpn)# svc dpd-interval gateway 3000
hostname(config-username-webvpn)#
svc dpd-interval client 1000
hostname(config-username-webvpn)#
Step 4 You can adjust the frequency of keepalive messages (specified by seconds) , to ensure that an SVC
connection through a proxy, firewall, or NAT device remains open, even if the device limits the time that
the connection can be idle.
Adjusting the frequency also ensures that the SVC does not disconnect and reconnect when the remote
user is not actively running a socket-based application, such as Microsoft Outlook or Microsoft Internet
Explorer.
To configure the frequency (15 through 600 seconds) which an SVC on a remote computer sends
keepalive messages to the security appliance, use the
svc keepalive command. Use the no form of the
command to remove the command from the configuration and cause the value to be inherited:
hostname(config-username-webvpn)# svc keepalive {none | seconds }
hostname(config-username-webvpn)# no svc keepalive {none | seconds }
hostname(config-username-webvpn)#
SVC keepalives are disabled by default. Using the keyword none disables SVC keepalive messages.
In the following example, the user configures the security appliance to enable the SVC to send keepalive
messages, with a frequency of 300 seconds (5 minutes):
hostname(config-username-webvpn)# svc keepalive 300
hostname(config-username-webvpn)#
Step 5
To enable the permanent installation of an SVC onto a remote computer, use the svc keep-installer
command with the installed keyword. To remove the command from the configuration, use the no form
of this command:
hostname(config-username-webvpn)# svc keep-installer { installed | none }
hostname(config-username-webvpn)# no svc keep-installer { installed | none }