Cisco ASA IPSec session timeout

[forrie]

We have remote users that need VPN access into our system when they're on-site -- we could provide them with a VPN for a laptop, but there is legitimate concern that leaving the laptop allow someone to get into our network.

We use the stock Cisco VPN Client for Windows and Mac. I'm wondering if there is some way to specify a session inactivity timeout (like perhaps 15 mins) and,

* can the setting be locked down locally so that the user can't increase it? (I would doubt this)
* I'd rather the setting not be applied to the account ... I don't want a user to always have a short timeout whether they are at home or at MaxD.


Anyone have experience with this?

Thanks.

 

[North323]

that can be set n the ASA with an idle time out command

 

[Supergrrover]

group-policy clientgroupname internal
group-policy clientgroupname attributes
vpn-idle-timeout 20


Hope this helps

Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[forrie]

Thank you for your responses.

I did find this info in the Admin Guide, too.

It will require us to create a separate group to enforce those settings on, along with separate user accounts. Not ideal, but doable.

My other thought was seeking an alternative IPSec client -- for both Windows and Mac (we use both, heavily), that might have additional client-side functionality.

There is VPNTracker for Mac -- which I've not yet gotten to work with the ASA (lack of time). We've all been using the stock Cisco VPN Client - and Cisco has announced they will not support client-side IPSec code anymore (as they told me on the phone).

Anyone have ideas of other software packages I could look into?

Thanks!