We have older firewalls that don't allow for scheduling up/down times of VPN connections, and we're working with a client that will need to connect to it at different times each day. What are the security risks (if any) of leaving open a VPN connection to a client?

We have the profile completely locked down to accessing only 1 specific server via 1 protocol.

  • None. Unless the physical machine is compromised.
    – Jason
    Commented Dec 17, 2013 at 17:41
  • Say their physical workstation does become compromised and someone logs into the VPN. Given they are only allowed FTP access to a specific server and a specific folder on that server, and they are only allowed to upload new files and not write/overwrite, read, or delete. Commented Dec 17, 2013 at 18:50

2 Answers 2


The risk presented in an always-available tunnel is negligible, especially if you have the traffic going over it restricted by firewall policy and monitored for suspicious activity.

The largest risk is a compromised system on their end - which is negated by a good firewall policy and IPS/IDS monitoring. A much more negligible risk would be an imposter tunnel - a rogue system with their IP and pre-shared key or XAUTH credentials. Even then, they're still running into the policy and IPS/IDS.

Defense in depth means this is generally a good risk tradeoff - it should be secure to keep the tunnel available at all times.


You shouldn't need to, firewalls are designed to drop VPNs after a period of inactivity. VPNs only come up when there's demand in the first place.

It may be that you have some sort of keepalive packet which is nailing the connection up, like monitoring traffic or a constant ping. That's not an issue from a security perspective, as long as you have your keys renegotiating based on time as well as data throughput.

  • Keepalive is a common config option on modern VPN appliances (like firewalls). There's no real security risk here, tho - the concern is resource utilization, most applications won't worry about the CPU/memory used by a live tunnel and have the keepalive option set. Commented Dec 17, 2013 at 18:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .