Cisco 500 Series, Руководство по настройке

Страница: 850 / 1140

38-14
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 38 Configuring AnyConnect VPN Client Connections
Configuring Advanced SSL VPN Features
gateway seconds enables DPD performed by the security appliance (gateway) and specifies the
frequency, from 5 to 3600 seconds, with which the security appliance (gateway) performs DPD.
gateway none disables DPD performed by the security appliance.
client seconds enable DPD performed by the client, and specifies the frequency, from 5 to 3600 seconds,
with which the client performs DPD.
client none disables DPD performed by the client.
To remove the svc dpd-interval command from the configuration, use the no form of the command:
Note
If you enable DTLS, enable Dead Peer Detection (DPD) also. DPD enables a failed DTLS connection
to fallback to TLS. Overwise, the connection terminates.
The following example sets the frequency of DPD performed by the security appliance to 30 seconds,
and the frequency of DPD performed by the client set to 10 seconds for the existing group-policy
sales :
hostname(config)# group-policy sales attributes
hostname(config-group-policy)# webvpn
hostname(config-group-policy)# svc dpd-interval gateway 30
hostname(config-group-policy)# svc dpd-interval client 10
Enabling Keepalive
You can adjust the frequency of keepalive messages to ensure that an SSL VPN connection through a
proxy, firewall, or NAT device remains open, even if the device limits the time that the connection can
be idle. Adjusting the frequency also ensures that the client does not disconnect and reconnect when the
remote user is not actively running a socket-based application, such as Microsoft Outlook or Microsoft
Internet Explorer.
To set the frequency of keepalive messages, use the svc keepalive command from group-policy webvpn
or username webvpn configuration mode:
[ no ] svc keepalive {none | seconds }
none disables client keepalive messages.
seconds enables the client to send keepalive messages, and specifies the frequency of the messages in
the range of 15 to 600 seconds.
The default is keepalive messages are disabled.
Use the no form of the command to remove the command from the configuration and cause the value to
be inherited:
In the following example, the security appliance is configured to enable the client to send keepalive
messages with a frequency of 300 seconds (5 minutes), for the existing group-policy
sales :
hostname(config)# group-policy sales attributes
hostname(config-group-policy)# webvpn
hostname(config-group-webvpn)# svc keepalive 300