sslvpn 2个小时掉线问题

问题：
同事反应两个小时sslvpn 会出现掉线问题发现是参数配置原因，设置了超时时间。


: s; i7 j( S# B! `( f修改为none
vpn-idle-timeout nonevpn-session-timeout nonewr


, v+ Y  ^% s& R. _9 e3 V6 o以下是官方解释：
, a  M& B6 K0 q# _* l; jhttps://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/81824-common-ipsec-trouble.html#solution13

, R" k$ u( C3 HVerify Idle/Session Timeout
If the idle timeout is set to 30 minutes (default), it means that it drops the tunnel after 30 minutes of no traffic passes through it.
! X( r; J, o9 R$ z3 ?0 RThe VPN client gets disconnected after 30 minutes regardless of the idle timeout parameter and encounters thePEER_DELETE-IKE_DELETE_UNSPECIFIEDerror.
Configureidle timeoutandsession timeoutasnonein order to make the tunnel alwaysup, and so that the tunnel is never dropped even when third party devices are used.
% b0 P2 B9 _5 ]1 b) ^& _+ o+ OASA
: {1 }+ [4 M0 M+ r4 i, G4 kEnter thevpn-idle-timeoutcommand in group-policy configuration mode or in username configuration mode in order to configure the user timeout period:
hostname(config)#group-policy DfltGrpPolicy attributeshostname(config-group-policy)#vpn-idle-timeout none
2 r8 `! `3 x6 c6 X+ {Configure a maximum amount of time for VPN connections with thevpn-session-timeoutcommand in group-policy configuration mode or in username configuration mode:
hostname(config)#group-policy DfltGrpPolicy attributeshostname(config-group-policy)#vpn-session-timeout none
When you havetunnel-allconfigured, you do not need to configureidle-timeoutbecause, even if you configure VPN-idle timeout, it does not work because all traffic goes through the tunnel (since tunnel-all is configured).
1 i( C" d: Q/ ~9 GTherefore, the interesting traffic (or even the traffic generated by the PC) is interesting and does not let Idle-timeout come into action.
Cisco IOS® Router
! d* L* X; n2 s- I; Y2 T! |Use thecrypto ipsec security-association idle-timecommand in global configuration mode or crypto map configuration mode in order to configure the IPsec SA idle timer.
By default IPsec SA idle timers are disabled.
crypto ipsec security-association idle-time seconds
Time is measured in seconds, which the idle timer allows an inactive peer to maintain an SA. Valid values for the seconds argument range from 60 to 86400.