sslvpn 2个小时掉线问题

问题：
$ m  ?  ?0 S+ o9 f8 ^3 y2 a- A& A1 V同事反应两个小时sslvpn 会出现掉线问题发现是参数配置原因，设置了超时时间。

1 X; C! o1 b/ N$ t' E
8 h# k( M4 o4 l6 p- q修改为none
vpn-idle-timeout nonevpn-session-timeout nonewr
# t% \9 }! ^, U7 e* d
7 n- X) O8 F% v) N6 G. W. x
以下是官方解释：
https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/81824-common-ipsec-trouble.html#solution13

' C) P5 |1 Z8 D* j$ P: L. {7 M7 DVerify Idle/Session Timeout
+ {" ^2 k- F( {, K1 B7 PIf the idle timeout is set to 30 minutes (default), it means that it drops the tunnel after 30 minutes of no traffic passes through it.
, R( h& s! u. x+ r& i/ a) VThe VPN client gets disconnected after 30 minutes regardless of the idle timeout parameter and encounters thePEER_DELETE-IKE_DELETE_UNSPECIFIEDerror.
Configureidle timeoutandsession timeoutasnonein order to make the tunnel alwaysup, and so that the tunnel is never dropped even when third party devices are used.
- ]+ a; N+ g% p1 r' [9 C# @5 D3 sASA
Enter thevpn-idle-timeoutcommand in group-policy configuration mode or in username configuration mode in order to configure the user timeout period:
2 [1 M: W1 E9 h0 Ghostname(config)#group-policy DfltGrpPolicy attributeshostname(config-group-policy)#vpn-idle-timeout none
( U! {$ J4 p- ]: c3 O, q' a8 U" p. \; QConfigure a maximum amount of time for VPN connections with thevpn-session-timeoutcommand in group-policy configuration mode or in username configuration mode:
hostname(config)#group-policy DfltGrpPolicy attributeshostname(config-group-policy)#vpn-session-timeout none
3 g" N3 R  a( T/ x& AWhen you havetunnel-allconfigured, you do not need to configureidle-timeoutbecause, even if you configure VPN-idle timeout, it does not work because all traffic goes through the tunnel (since tunnel-all is configured).
$ K: k) _9 Y8 s7 a* M, S" |Therefore, the interesting traffic (or even the traffic generated by the PC) is interesting and does not let Idle-timeout come into action.
Cisco IOS® Router
Use thecrypto ipsec security-association idle-timecommand in global configuration mode or crypto map configuration mode in order to configure the IPsec SA idle timer.
0 Q& a" S1 r; p% R# pBy default IPsec SA idle timers are disabled.
crypto ipsec security-association idle-time seconds
0 B$ B# o4 V9 ^* N6 {/ wTime is measured in seconds, which the idle timer allows an inactive peer to maintain an SA. Valid values for the seconds argument range from 60 to 86400.
6 Y, V5 g, I/ J
) p+ ^4 M1 E& d. h( _9 _