Permanent tunnel question

[the_rock]

Hey guys,

I had a question and I hope someone can give an answer. Just wondering, when someone sets up vpn site to site with say 1 central gateway and bunch of satellite gateways and its set as permanent tunnel, should tunnel management have 1 subnet per pair or gateway? Also, should tunnel_keepalive_method be set to tunneltest on all sides, or dpd on central gw and tunnel test on others?

Reason I ask is because we have customer who has intermittent vpn disconnect issues and sadly, TAC cant find any sk's or documents advising on how permanent tunnels between cp devices should be configured.

They have tunnel_keepalive_method set in guidbedit to dpd for central cluster and as tunneltest for all satellite ones and all satellite gw's are 1100 managed by another management server and all configured as externally managed gateways in dashboard for vpn purpose, so 1 central gateway in community and about 20 satellite ones, same vpn star community.

This all worked fine for so many months and all of a sudden yesterday, things started ocurring without any changes,

Any insight would be appreciated!

Thanks as always!

[Ruan_Kotze]

Long shot, but does this perhaps correlate with policy pushes?  I ran into the issue described in sk142355 a couple of times already.

[the_rock]

Thank you for the reply, but not related. Customer has that enabled and VPN tunnels issue happens randomly, never after policy push.