Tunnel Timeouts - Nortel BayStack Instant Internet 100-S Using Manual

This situation occurs due to a limitation of the IPsec protocol; however, there are
two ways you can work around this limitation:
• Maintain traffic in the tunnel in both directions on a relatively constant basis.
This option is possible only when the dial-up connection can exist at all times.
One way to maintain traffic is to send a ping command back and forth from
each gateway's network to the other.
• Reduce the VPN connection timeout. By using shorter timeouts, you can
determine the maximum amount of time required for the system to recover.
Before you implement this solution, consider that substantial computational
overhead is required. For example, an Instant Internet unit model 100 requires
approximately 11 seconds to perform the phase 1 negotiation, so every time
the primary tunnel is re-keyed, traffic is interrupted for that amount of time
(on the model 400 unit this process requires approximately one second).
Note: The phase 1 negotiation timeout is controlled on the CES with the
Forced Logoff parameter, whereas a subnet tunnel is controlled by the
re-key timeout.
• Use a ping to monitor or control the tunnel (refer to
page 173).

Tunnel timeouts

The Instant Internet unit's IPsec feature performs all communications across a
Security Association (SA), also referred to as a tunnel. An SA is negotiated using
Internet Key Exchange (IKE) standards using two main types of negotiation,
phase 1 and phase 2, and a timeout (specified by time or amount of data) is
associated with each SA. When this timeout expires, the SA is no longer valid and
a new one must be negotiated if needed. The phase 1 negotiation uses a very
secure algorithm that establishes secure communications between the gateways
(the Instant Internet unit and the CES) but does not refer to any specific tunnel.
When phase 1 is complete, additional SAs are negotiated using the phase 2
protocol, with the keys exchanged across the secure phase 1 tunnel. These SAs
refer to specific network pairs.
Using the BayStack Instant Internet Management Software Version 7.11
Chapter 6 IP security and VPN
"Using Pings" on
187