GRE VPN & KEEP ALIVE

Dear all,
i am having problem with make keep alive connectivity all the time between 2 nodes.
I have A and B cisco routers established GRE VPN over ISP. Problem starts with when there are no active connection from host of A to host of B. It looks like VPN down. Another problem is when A 's having temp power outage and when power comes there is no active connection even WAN protocol is down.When reload A router manually then connection comes up.
I am thinking that maybe some configuation like keep alive retry something like that.
Do guys have any idea on this matter ?

GRE tunnels are usually used in combination with a dynamic routing protocol that keeps the tunnel up and active. If you are using static routes there is no traffic to keep the tunnels up when the applications are not transmitting.
You have two options:
1. Increase the isakmp/ipsec lifetimes.
http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/products_configuration_guide_chapter09186a00800d981f.html#1001095
2. Setup keepalives (Best Option)
crypto isakmp keepalive (Number of seconds between keep alives) (Number of seconds between retries if keepalive fails)

Similar Messages

IPSec Tunnel - Keep alives

Hi All,
Have just configured an IPSec VPN peered with a Fortigate 610B. The issue i am having is that the line-protocol keeps going down due to inactivity on the tunnel.
I have keep alives configured as you will see below, however they dont appear to be working...
Any suggestions would be appreciated.
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key <password> address y.y.y.y
crypto isakmp keepalive 10
crypto ipsec transform-set 3DES-SHA-HMAC esp-3des esp-sha-hmac
crypto ipsec profile Crypto-01
set transform-set 3DES-SHA-HMAC
interface Tunnel1
ip address 10.255.255.5 255.255.255.252
keepalive 5 3
tunnel source x.x.x.x
tunnel destination y.y.y.y
tunnel mode ipsec ipv4
tunnel protection ipsec profile Crypto-01
service-policy output p-map01
CLEC-C2811-VPNC#sh interfaces tunnel 1
Tunnel1 is up, line protocol is down
Hardware is Tunnel
Internet address is 10.255.255.5/30
MTU 1514 bytes, BW 9 Kbit, DLY 500000 usec,
     reliability 255/255, txload 1/255, rxload 1/255
Encapsulation TUNNEL, loopback not set
Keepalive set (5 sec), retries 3
Tunnel source x.x.x.x, destination y.y.y.y
Tunnel protocol/transport IPSEC/IP
Tunnel TTL 255
Fast tunneling enabled
Tunnel transmit bandwidth 8000 (kbps)
Tunnel receive bandwidth 8000 (kbps)
Tunnel protection via IPSec (profile "Crypto-01")
Last input never, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 1
Queueing strategy: fifo
Output queue: 0/0 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
     172 packets input, 17949 bytes, 0 no buffer
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     118 packets output, 10052 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 output buffer failures, 0 output buffers swapped out

Remove the keep alive config from the tunnel, I have found that keepalives only work on default GRE tunnel mode/encapsulation.
Sent from Cisco Technical Support iPad App

Keep alive using plain DHCP

Hi. My ISP assigns IPs using DHCP and then requires a manual login via an HTML form. After that you will be automatically logged out after some time of inactivity.
I'm looking into buying the WRV200 and wonder if I can set it up to remain connected despite user inactivity. I see it has keep alive for PPPoE etc, but I can't use PPPoE.
Is there any other way to keep the connection alive? By creating a VPN tunnel and set a key lifetime lower than my ISPs timeout??? Or does the VPN disconnect after some inactivity too...?
Thanks in advance.

I keep the same IP for months at a time, so that is not the problem.
The problem is that after 1 hour (or so) with no traffic sent from my IP, all the traffic from my endpoint is blocked until I manually log in again via a web form that, I am redirected to whatever URL I enter in the browser.
So if there is any way to make the router send a package every x minutes, I would stay logged on.
(IPSec key exchange would be such a package, if those are sent even when the tunnel is not in use from any computer on my LAN.)
There is software avalable for the PC that sends these keep alive packages, but I want the router to send them so that I can check my e-mail using my WLAN enabled cell phone even though I have had the PC turned off for hours.

"Keep Alive" parameter for listener?

Hi all,
we have following problem:
From time to time the client (oracle forms 6i patch 18) gets the error message ORA-03114. Te solution is only to kill forms application and start it again.
This hangs probably on the network breaks in the communication (over VPN) with the database.
Is there any parameter for listener like "Keep alive" or else, which can rebuild the connection once it lost?
Best regards

Paste this into the SQLNET.ORA on the application server or the server that is making the SQL calls to the database.
Trace_level_client=16
Trace_directory_client=<path_to_the_trace_directory> # use the full path to the trace directory
Trace_unique_client=on
Trace_timestamp_client=on
Then review the trace or you can try the keep alive in windows
Use the standard TCP KeepAlive on Windows
1. Open the registry under:
HKEY_LOCAL_MACHINE: SYSTEM: CurrentControlSet: Services: Tcpip:
Parameters
2. Add KeepAliveTime : REG_DWORD to the registry
3. Set the value to a reasonable timeout.(decimal and NOT Hex) Like 480000 equals 8 minutes or 120000 equals 2 minutes etc etc.
- Save this
- Reboot

HFM Web Sever Configuration--Keep Alive and Session Time Out Optimal Config

We recently implemented an HFM 9.3.1 environment. We are using Windows 2003 Enterprise SP2 servers with IIS6. We have two HFM Web servers connecting to an application cluster with two application servers in the cluster. We were getting some errors when trying to unlock HFM cells in Workspace, but we were able to perform the functions fine on the application using the WIN32 client.
I opened a ticket with support and they recommended modifying the subcontext.properties file located in %HYPERION_HOME%\deployments\WebLogic9\servers\Workspace\webapps\workspace\conf. They recommended changing the following settings:
#KeepAliveInterval=30
#SessionTimeout=60
From what I understand, these settings are for the communication between the HFM Web Servers and the application cluster servers. I'm wondering how changing these settings may affect our environment. Are there negative effects and/or trade-offs for changing these settings? Is there a recommended threshold or maximum value?

Hi Dinesh,
This cannot be achieved without development enhancements to some standard SAP framework component, to introduce a "keep-alive" concept. If you are using a CMS for CTI or email integration, you need to ensure it supports keeping the communications session alive also.
Sincerely,
Glenn
Glenn Abel
Covington Creative
www.covingtoncreative.com

Keep-alive problem in apache/weblogic

I have a server with Weblogic 5.1 and Apache
1.3.12 with the weblogic-plugin.
When apache serves pages, the keep-alive works
fine.
When weblogic serves pages, the keep-alive works
fine.
When i added a handler in apache so all requests
to apache should go to weblogic through the
plugin, the keep-alive stopped working.
Anyone seen this before?
Gunnar

send a message to [email protected] with as much info as you can. i d
on't think they're watching the newsgroups for bug reports.
maybe someone who frequents the newsgroups regularly could do a FAQ...
anyone actually got time?
"Gunnar" <[email protected]> wrote in message
news:3a51995e$[email protected]..
In case anyone wondered:
I tried with sp5 and sp7 and everything worked fine. It seems sp6 is
buggy...
Gunnar <[email protected]> skrev i
meldingsnyheter:3a41e618$[email protected]..
I have a server with Weblogic 5.1 and Apache
1.3.12 with the weblogic-plugin.
When apache serves pages, the keep-alive works
fine.
When weblogic serves pages, the keep-alive works
fine.
When i added a handler in apache so all requests
to apache should go to weblogic through the
plugin, the keep-alive stopped working.
Anyone seen this before?
Gunnar

How to keep alive a session in Web Services?

I have to do my project, that will be including some following features:
1. Login to Application through Web Services method. For example:
http://mydomain.com/web-services/Login?WSDL
2. After logging in, use mySms method to send message to Cellphone through Web Services! For example:
http://mydomain.com/web-services/mySms?WSDL
My questions are:
1. How can I keep alive the session after logging in the application in Web Services? In Web, I can use "Session".
2. If someone has not logged in the Application, he/she could not use mySms method for sending Sms. How can I do that?
3. I know, when I invoke a Web Services, one JavaBean has been called, and this bean is persistence with his own states. It means, if I set value to parameters of this bean, these values are persistence for invoked methods by other persons.
For example:
mySms bean has a private field "jid" inited with NULL value.
Person A invoked mySms.
Then, A set jid of mySms to value "A".
Person B invoked mySms. B got jid value. He receive the result value is "A".
The question is, how can I set mySms bean so that mySms bean is not persistence?
Thanks many!

Hi,
I can right away answer your FIRST Question.
Since WebServices are PURELY Based on SOAP which is in tern based on HTTP, they rely on a Stateless protocol.
I am sure you know that the HTTP is the STATELESS Protocol and so you can not maintain Session and so EACH Http REQUEST is considered as a SEPERATE REQUEST.
Now, still you want to maintain the Session in WebServices,
The simple answer is PASSING PARAMETERS.
Just Maintain your Session on Client (If you are using JSPs or Servlets to CAll WEBSERVICES then maintain Session through your HTTPSession) and each time you Invoke WebService PASS ON REQUIRED Parameters.
This Approach is Exactly like your URL REWriting OR your Parameters Passing through QUERY STRINGS.
I hope you got what I am saying!
Take care,
Himanshu/

WRT54G v 7.0 -- Setting "Keep Alive: Redial Period" not correct (radio button)

Hi,
I own a Linksys-Router WRT54G v7.0 with firmware v7.00.8 build 008, Jul. 9, 2009.
On the web GUI (Setup/Basic Setup) there's a setting "Keep Alive: Redial Period XX Sec.". As I'd like to stay connected with my provider permanently, I've set the radio button to "Keep Alive: Redial Period" and the according text field to "30" seconds. Then, I've clicked "Save Settings" and got a confirmation message that the settings got saved.
Anyway, even after saving the settings the according radio button is still set to "Connect on Demand...". But that is only true for newer browsers, like e.g. IE8, IE7 or Firefox 8. If you use an older browser, like e.g. IE6, then the radio button is correctly set to "Keep Alive: Redial Period" with a value of "30" seconds.
Conclusion: The settings get correctly saved by the router (I can confirm that), but they don't get correctly shown in the web GUI. Looks like a HTML/Javascript bug in the router's admin web GUI. That's really annoying as you never exactly know the effective settings...
Can someone confirm that bug? Is there a newer firmware than version 7.00.8?
Regards,
Patrick

Try to clear the browser's cache as well.
"Don't fix it if it ain't broken."

Weblogic proxy plugin closes keep-alive connections to clients randomly

In short we have following arhitecture:
clients ---> wl proxy plugin 1 ----> weblogic 1
clients ---> wl proxy plugin 2 ----> weblogic 2
Beacuse of the application/installation specific requirements, we are not using failover, one wl proxy always forwards requests to one weblogic (simple configuration).
Application is TR-069 protocol based (SOAP over HTTP) so it very much relays on persistence TCP connections (Connection: keep-alive). This TCP persistence has to work correctly in order that TR-069 messages are exchanged in required order, otherwise we have a error on application layer.
Here and there we've noticed applications errors which suggest that we have some problems in TCP connection between the client and the weblogic server. After sniffing, we've noticed that weblogic proxy plugin (Apache) randomly, or because of some other reason we do not know, decides to close TCP connection to client, even app on weblogic did not request so ???
As a result, client opens new connection to the server with new TR-069 session and it gets bounced beacuse it allready has one open on weblogic server.
We've sniffed, traced everything we could, we were searching for patterns in time, etc... but we can not find the reason why proxy plugin decides to close the connection to the client (not to the weblogic server).
Trace (replaced sensitive information):
Thu Apr 29 15:05:50 2010 <958012725463463784> URL::parseHeaders: CompleteStatusLine set to [HTTP/1.1 200 OK]
Thu Apr 29 15:05:50 2010 <958012725463463784> URL::parseHeaders: StatusLine set to [200 OK]
Thu Apr 29 15:05:50 2010 <958012725463463784> parsed all headers OK
Thu Apr 29 15:05:50 2010 <958012725463463784> sendResponse() : r->status = '200'
Thu Apr 29 15:05:50 2010 <958012725463463784> canRecycle: conn=1 status=200 isKA=1 clen=545 isCTE=0
Thu Apr 29 15:05:50 2010 <958012725463463784> closeConn: pooling for '$IP$/$PORT$'
Thu Apr 29 15:05:50 2010 <958012725463463784> request [$URL$] processed successfully..................
!!!! Now it closes the TCP connection and inserts "Connection: close" HTTP header !!!
WL proxy plugin conf params are:
WebLogicCluster $IP$:$PORT$
DynamicServerList OFF
KeepAliveTimeout 90
MaxKeepAliveRequests 0
KeepAliveSecs 55
Apache worker configuration is:
<IfModule mpm_worker_module>
PidFile var/run/httpd-worker.pid
LockFile var/run/accept-worker.lock
StartServers 2
MinSpareThreads 25
MaxSpareThreads 75
ThreadLimit 200
ThreadsPerChild 200
MaxClients 2000
MaxRequestsPerChild 0
AcceptMutex pthread
</IfModule>
Why weblogic proxy plugin ignores Keep-alive directive and decides to close connection to the client by itself?
Any help?

If a WebLogic Server instance listed in either the WebLogicCluster parameter or a dynamic cluster list returned from WebLogic Server fails, the failed server is marked as "bad" and the plug-in attempts to connect to the next server in the list.
MaxSkipTime sets the amount of time after which the plug-in will retry the server marked as "bad." The plug-in attempts to connect to a new server in the list each time a unique request is received (that is, a request without a cookie).
Note: The MaxSkips parameter has been deprecated as the MaxSkipTime parameter.
See also here: http://download-llnw.oracle.com/docs/cd/E13222_01/wls/docs81/plugins/plugin_params.html
You said the problem arises under significant load. Maybe, it is wise to tune the number file descriptor's on your operating system. HTTP connections are nothing more than TCP sockets on the operating system. All modern operating systems treat sockets as a specialized form of file access and use data structures called file descriptors to track open sockets and files for an operating system process. To control resource usage for processes on the machine, the operating system restricts the number of open file descriptors per process. You should be aware that all TCP connections that have been gracefully closed by an application will go into what is known as the TIME_WAIT state before being discarded by the operating system.
On most unix systems you can use netstat -a | grep TIME_WAIT | wc -l to detemine the number of socket in time_wait state. You have to check with your system adminstrator how to tune the tcp_time_wait_interval. On solaris you can use: /usr/sbin/ndd -set /dev/tcp tcp_time_wait_interval 60000

Which port to use for the peer-keep alive

Hi All,
We have 2 Nexus 6001s in our data center.
The management port of each 6001 is connected to the other and this link is used as the peer keep alive link.
My colleague is suggesting that we use one of the inline data ports as the keep alive link.
Can you please advise on the pros and cons of using management/inline port as keep live link and the best practise to follow in this case?
Thanks,
Pete

Hi Pete,
Here are the best recommendation in order of preference.
1. Use mgmt0 (along with management traffic)
* Pros: whats good on this option is you are totally separating the VPC Peer keepalive link on another VRF (management) and does not mingle with the data or global vrf..
* Cons: VPC PKL is dependent on the OOB management switch.
2. Use dedicated 1G/10GE front panel ports.
* Pros - can just be a direct link between the N6K pair and not dependent on other boxes.
* Cons - you need extra SFPs for VPC PKL while the VPC PKL traffic join the global VRF.
HTH
Jay Ocampo

Need help with HTTP keep-alive

Hi folks!
I have this very simple web server and I would like to add keep-alive support. I've been trying to get my head around it for a while and could need some help (I found this question in the archive, but those replies didn't help)...
This is my starting point (stripped down to the basics):
/* A listener thread that accept incoming requests by creating new request handlers */
public class HTTPListener implements Runnable
    private ServerSocket serverSocket;
    public HTTPListener(int port)
        // Try to create a server socket on specified port
        try
            serverSocket = new ServerSocket(port, 0);
        catch (IOException ex)
            System.err.println("Oops!");
    public void run()
        while (!Thread.interrupted())
            try
                // Listen on server socket until a request arrives
                Socket s = serverSocket.accept();
                // Create handler to service request
                RequestHandler h = new RequestHandler(s);
                new Thread(h).start();
            // Server socket closed when listening
            catch (SocketException ex)
                Thread.currentThread().interrupt();
            // Failed to close socket or failure during server socket accept
            catch (IOException ex)
                System.err.println("Failed to accept request");
        try
            serverSocket.close();
        catch (IOException ex)
            System.err.println("Hmpf...");
/* Handler that prints out requests and always answers with status 200 */
public class RequestHandler implements Runnable
    private Socket socket;
    public RequestHandler(Socket s)
        socket = s;
    public void run()
        System.out.println(">>> New request handler");
        try
            BufferedReader reader = new BufferedReader(new InputStreamReader(socket.getInputStream()));
            String str;
            while ((str = reader.readLine()) != null)
                System.out.println(str);
            sendDummyReplyWithKeepAlive();
            reader.close();
            socket.close();
        catch (IOException ex)
            System.err.println("Crap, got an exception!");
}When I run the server (which in reality has a little more to it) I never get more than one request printed for each ">>> New request handler", which is not surprising!
Now, with keep-alive support I expect to get consecutive requests from the same client printed by the same handler instance. What I have to do (as I've understood from my readings) is to modify the while loop in the request handler that reads from the socket so that it spins until the connection is closed by the client (or a keep-alive timeout occurs) and blocks while there is nothing to read.
Perhaps I'm being stupid now, but how do I actually do this?

ejp wrote:
and also an incorrect implementation of the timeout period. This code will still wait forever if no data arrives.You're right... actually I didn't mean to put that while loop there! What I meant was simply
if (!reader.ready())
    wait(keepAliveTimeout);
if (!reader.ready())
    break mainLoop;
// If we get here there is a new request to read...and I agree that it's ugly, that's why I'm asking you guys for help!
setSoTimeout() is of course a way to go... didn't think of that although I have kind of already added it to my code but with a different timeout. Thanks!
Last question then is:
does reader.readLine() block like reader.read(), or do I have to use the latter?
I would test for myself I could, but at the moment I can't...

Changing Default "Keep Alive" & " Max Processing Time" values in SMICM

Dear Experts
As you aware the default values in SMICM --> Go to --> Services The default values "Keep Alive" & " Max Processing Time" of services like HTTP & HTTPS is 30 sec & 60 seconds respectively.
Every times when we restart application server - we are increasing the time values manually. once we restart they will be reset to original 30 & 60 sec respectively.
I want to make customozed values permanently which should not be lost even after restart of application server.
Please Help
Regards
PR

If you have not set the PROCTIMEOUT parameter, TIMEOUT (or icm/keepalive_timeout) defines both the processing timeout and the keepalive timeout. Also, as of release 6.40, the keepalive timeout is limited to a maximum of 30 seconds.
In a system where the default timeout settings of 30 seconds for the keepalive timeout and the processing timeout are not sufficient because of long-running applications, we recommend that you set the TIMEOUT and PROCTIMEOUT parameters for the relevant services so that you can configure them independently of each other. In addition, we recommend that you do not set the TIMEOUT value higher than necessary, for example, to the usual default value of 30 seconds.
We recommend, for example, the following settings:
icm/server_port_0 = PROT=HTTP,PORT=1080,TIMEOUT=30,PROCTIMEOUT=600
to allow a maximum processing time of 10 minutes.
Thanks,
Tanuj

Is it best practice to use a dedicated link between NX7K pair for keep-alive?

I have been using dedicated physical 10G link between pair of NX7k for keep-alive. Is it a best practice? It seems a waste of 10G ports because keep-alives does not need that much bandwidth.
I'm thinking just configure a dedicated VLAN interface in the default VRF, and have it routed through other devices (fir example 6509 core switches) for keep-alive. Has anyone done that before? The goal is not to use dedicated 10G ports for keep-alive.
Thanks a lot.

gwhuang5398 wrote:I have been using dedicated physical 10G link between pair of NX7k for keep-alive. Is it a best practice? It seems a waste of 10G ports because keep-alives does not need that much bandwidth.I'm thinking just configure a dedicated VLAN interface in the default VRF, and have it routed through other devices (fir example 6509 core switches) for keep-alive. Has anyone done that before? The goal is not to use dedicated 10G ports for keep-alive.Thanks a lot.
I agree that using a Tengig port for this purpose is not efficient. The whole idea of peer-keepalive is to have a way to avoid split brain scenarios in case of peer-link failure. For this reason the peer-keepalives should never cross the peer-link as it defeats the original purpose I just cited. Following are some viable options:
You can use the N7K management ports for peer-keepalive functionality. If you have redundant supervisors then make sure you use an external switch (OOB switch for example) to patch the management ports.
You can use dedicated interfaces just like you are doing right now but that would make more sense if you had Gig ports in my opinion.
You can run peer-keepalives inband but you need to make sure this traffic is never routed over the peer-link. It is considered a good practice to use a dedicated VRF for this purpose.
Atif

Keep alive script for HTTPS service with GET method

Hello,
I tried to implement a keep alive to services that support HTPS connections. Ive created a script that opens a tcp connection on port 443 and tries to do a GET of a test web page. This web page only displays OK.
In a resumed form I used the following script commands:
Socket connect host 192.168.136.134 port 443 tcp
Socket send ${SOCKET} GET /teste.template\n\n
Socket waitfor ${SOCKET} 200 2000
Socket disconnect ${SOCKET} graceful
I was unable to receive the expected 200 response and received a message saying string not found, I used the socket inspect command to inspect the sockets internal data buffer and the result was nothing, it seemed empty.
I tried the same operation using a linux machine that has IP connectivity with the Webservers and I was successful.
In the same CSS I have services configured to respond to HTTP sessions. I tried the following script and everything went well
Socket connect host 192.168.136.151 port 80 tcp
Socket send ${SOCKET} HEAD /index.html\n\n
Socket waitfor ${SOCKET} 200 2000
Socket disconnect ${SOCKET} graceful
When I issued the socket inspect command I could in fact see the sockets internal data buffer content.
The CSS is running WebNS 5.0 build 66
Can someone give me a help?
Thanks,
Ricardo Lourenço

Hello,
There is no direct no direct link between TCP and SSL.
So, in spite of having success with the TCP port 443 connection the CSS will not be able to negotiate de security parameters necessary to establish the SSL session.
This was the reason for not having success through the use of the socket commands, as i refered in my original message.
Thanks for your collaboration,
Ricardo Lourenço

Keep alive a session between 2 BAPI calls

Hi -
I am calling several BAPIs to maintain data. I am calling from an outside system as I published the BAPIs as Web Services.
I would like that the session between 2 BAPI calls is kept, so I don't miss some session info between call #1 and call #2.
Anyone knows a way of keeping alive a session between 2 BAPI calls?
Thanks !

Try this..
<b>ARFC with Resource Management (Parallel Remote Function Call)</b>
CALL FUNCTION 'MYFUNC'
STARTING NEW TASK 'T1'
DESTINATION IN GROUP 'PRFC'
EXPORTING ...
TABLES ...
EXCEPTIONS ...
communication_failure = 100
system_failure = 101
resource_failure = 200.
IF sy-subrc= 102.
wait and retry...
ENDIF.
<b>Define PRFCvia RZ12</b>
Amandeep

GRE VPN & KEEP ALIVE

Similar Messages

Maybe you are looking for