IPSEC隧道远端HP 401N打印机3分钟后停止响应ping，本地正常

Let's start by grounding this in your specific setup: you've got a StrongSWAN-to-Cisco ASA 9.8.1 IPsec tunnel across 100Mbps AT&T fiber + hybrid data center bandwidth, most devices have zero ping loss, but your HP 401N printer stops responding to remote pings after ~3 minutes (local pings stay rock-solid). Here's how to dig into this:

• Check IPsec SA/ISAKMP Lifetime Mismatches
  Cisco ASA 9.8.x has default lifetimes for ISAKMP (IKEv1) and IPsec SAs that might not align with StrongSWAN's defaults. Mismatched lifetimes can cause tunnel re-negotiation that some devices handle better than others (like your printer).

  • On the ASA, run show run crypto isakmp and show run crypto ipsec to check default lifetimes.
  • In StrongSWAN's ipsec.conf, look for the lifetime parameter in your connection block.
  • Align both sides to consistent values (e.g., 86400 seconds for ISAKMP, 3600 seconds for IPsec SA) to ensure re-negotiations happen smoothly across all devices.

• Audit Printer Network Timeout/Sleep Settings
  HP 401N printers often have aggressive power-saving or network idle timeouts that can kill remote connectivity while leaving local access intact.

  • Log into the printer's web admin interface, navigate to Network Settings → TCP/IP Configuration → Advanced Settings.
  • Look for settings like ICMP Idle Timeout or Network Sleep Mode—disable any network-related power-saving features, or extend the timeout window beyond 3 minutes.

• Verify NAT Exemption & ACL Rules on ASA
  Even if your tunnel works for other devices, it's possible the printer's IP is falling through a crack in your ASA's rules:

  • Confirm your NAT exemption (no-NAT) rule explicitly includes the printer's IP address/subnet for the tunnel. Run show run nat to check.
  • Ensure the outbound ACL for the IPsec tunnel doesn't have time-based restrictions that would block the printer's traffic after 3 minutes.

• Capture Traffic During the Drop
  To get concrete data, run simultaneous packet captures on both ends when the ping stops:

  • On the remote site (ping initiator), use tcpdump host <printer-ip> to see if ping requests are reaching the ASA.
  • On the local site (printer side), run the same tcpdump command to check if requests arrive at the printer, and if the printer sends ICMP replies back.
  • Watch for IKE re-negotiation packets around the 3-minute mark—if the drop lines up with re-negotiation, you might have a compatibility issue between StrongSWAN and ASA's re-negotiation logic (e.g., mode mismatches like Main vs. Aggressive).

• Adjust MTU to Avoid Fragmentation
  IPsec adds overhead to packets, which can cause fragmentation issues that printers handle poorly:

  • Lower the printer's MTU to 1400 (from the default 1500) via its web admin interface.
  • On the ASA, enable crypto ipsec df-bit clear to allow packet fragmentation through the tunnel.
  • In StrongSWAN's ipsec.conf, add mtu=1400 to your connection block to match.

• Test Beyond ICMP
  Ping is a basic test—check if other traffic to the printer fails too:

  • Try accessing the printer's web interface from the remote site, or send a print job, and see if it drops at the 3-minute mark.
  • If only ping fails, check the ASA for ICMP rate-limiting policies: run show run policy-map and show run class-map to see if any rules are throttling ICMP traffic from the printer.

内容的提问来源于stack exchange，提问作者user1955162