topic Soft and hard lifetime in IPSec in Next-Generation Firewall Discussions

Soft and hard lifetime in IPSec

AY_FASAR — Mon, 31 Mar 2025 15:45:37 GMT

Hi,

I think I understand what is soft lifetime, but I can't see anywhere in Ipsec config to set it, is it something that palo alto set by default based on the hard lifetime.

Also having some issues with my tunnel and when set the debug the soft lifetime between palo alto and other end (different vendor) doesn't match, can this cause the issue?

Thanks

Re: Soft and hard lifetime in IPSec

ozheng — Wed, 09 Apr 2025 05:11:26 GMT

Hello @AY_FASAR ,

The soft timer is not configurable, it is based on the hard lifetime.

For your troubleshooting, the soft timer mismatch should not affect the tunnel establishment.

You can also check https://live.paloaltonetworks.com/t5/pancast-episodes/pancast-episode-12-troubleshooting-ipsec-tunnels/ta-p/532287

Olivier