Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 1949 / 2164

1-21
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring AnyConnect VPN Client Connections
Configuring AnyConnect Connections
hostname(config-group-policy)# webvpn
hostname(config-group-webvpn)# anyconnect ssl rekey method ssl
hostname(config-group-webvpn)# anyconnect ssl rekey time 30
Enabling and Adjusting Dead Peer Detection
Dead Peer Detection (DPD) ensures that the ASA (gateway) or the client can quickly detect a condition
where the peer is not responding, and the connection has failed.
To enable DPD on the ASA or client for a specific group or user, and to set the frequency with which
either the ASA or client performs DPD, use the
anyconnect dpd-interval command from group-policy
or username webvpn mode:
anyconnect dpd-interval {[ gateway { seconds | none }] | [ client { seconds | none }] }
Where:
gateway seconds enables DPD performed by the ASA (gateway) and specifies the frequency, from 5 to
3600 seconds, with which the ASA (gateway) performs DPD.
gateway none disables DPD performed by the ASA.
client seconds enable DPD performed by the client, and specifies the frequency, from 5 to 3600 seconds,
with which the client performs DPD.
client none disables DPD performed by the client.
To remove the anyconnect dpd-interval command from the configuration, use the no form of the
command:
no anyconnect dpd-interval {[ gateway { seconds | none }] | [ client { seconds | none }] }
Note
If you enable DTLS, enable Dead Peer Detection (DPD) also. DPD enables a failed DTLS connection
to fallback to TLS. Otherwise, the connection terminates.
The following example sets the frequency of DPD performed by the ASA to 30 seconds, and the
frequency of DPD performed by the client set to 10 seconds for the existing group-policy
sales :
hostname(config)# group-policy sales attributes
hostname(config-group-policy)# webvpn
hostname(config-group-webvpn)# anyconnect dpd-interval gateway 30
hostname(config-group-webvpn)# anyconnect dpd-interval client 10
Enabling Keepalive
You can adjust the frequency of keepalive messages to ensure that an SSL VPN connection through a
proxy, firewall, or NAT device remains open, even if the device limits the time that the connection can
be idle. Adjusting the frequency also ensures that the client does not disconnect and reconnect when the
remote user is not actively running a socket-based application, such as Microsoft Outlook or Microsoft
Internet Explorer.
Note
Keepalives are enabled by default. If you disable keepalives, in the event of a failover event, SSL
VPN client sessions are not carried over to the standby device.
To set the frequency of keepalive messages, use the keepalive command from group-policy webvpn or
username webvpn configuration mode: