Intermittent IPsec connection

i.rifai — Wed, 05 Aug 2026 07:18:27 GMT

We recently setup IPsec tunnel between PA-1410 and 3rd party device. We can see the tunnel is up, but when testing ping between endpoint on our side to endpoint on the peer's side there are frequents request timed out.

Our configuration for IKE crypto using sha256, aes-256-cbc, DH group 19, lifetime 24 hours. For IPsec crypto we use sha256, aes-256-cbc, DH group 19 and key lifetime 1 hours. Our local IP is 10.121.0.78 and peer IP 10.250.30.50.

From traffic log there are no packet drop, even packet capture from tunnel interface and the endpoint IP for destination doesn't show any packet drop.

I have collected the debug using these following commands:

debug ike global on debug

debug ike pcap on

On ikemgr.log I have found that there is frequent IPSEC KEY LIFETIME EXPIRED, even happened only a few seconds. From the system log, I didn't found tunnel down or tunnel up on a frequent basis. But, what I found weird is that IPSEC KEY LIFETIME EXPIRED is happened frequently.
Below is the example of the log

2026/08/04 15:18:12 2026-08-04 15:18:12.000 +0700 [DEBG]: 10.86.51.3[500] - 10.86.51.1[500]:(nil) 1 times of 80 bytes message will be sent over socket 1025 2026/08/04 15:18:12 2026-08-04 15:18:12.000 +0700 [PNTF]: { 4: 27}: ====> IPSEC KEY LIFETIME EXPIRED; tunnel ALTO-IPSEC-TUNNEL-DRC <==== 2026/08/04 15:18:12 ====> Expired SA: 10.121.0.78[500]-10.250.30.50[500] SPI:0xFC61DEB1/0x9AD641EC <==== 2026/08/04 15:18:12 2026-08-04 15:18:12.000 +0700 [PNTF]: { 4: 27}: ====> IKEv2 CHILD SA DELETED AS RESPONDER, non-rekey; tunnel ALTO-IPSEC-TUNNEL-DRC <==== 2026/08/04 15:18:12 ====> Deleted SA: 10.121.0.78[500]-10.250.30.50[500] message id:0x00008536, SPI:0xFC61DEB1/0x9AD641EC parent SN:10069 <==== 2026/08/04 15:18:12 2026-08-04 15:18:12.000 +0700 [INFO]: { 4: }: ikev2_request_initiator_start: SA state ESTABLISHED type 3 caller ikev2_child_delete 2026/08/04 15:18:12 2026-08-04 15:18:12.000 +0700 [INFO]: { 4: }: IKEv2 INFO transmit: gateway Alto-DRC, message_id: 0x00008535, type 3 SA state ESTABLISHED 2026/08/04 15:18:12 2026-08-04 15:18:12.000 +0700 [DEBG]: 10.121.0.78[500] - 10.250.30.50[500]:(nil) 1 times of 80 bytes message will be sent over socket 1024 2026/08/04 15:18:12 2026-08-04 15:18:12.000 +0700 [PNTF]: { 4: 27}: ====> IPSEC KEY DELETED; tunnel ALTO-IPSEC-TUNNEL-DRC <==== 2026/08/04 15:18:12 ====> Deleted SA: 10.121.0.78[500]-10.250.30.50[500] SPI:0xFC61DEB1/0x9AD641EC <==== 2026/08/04 15:18:12 2026-08-04 15:18:12.000 +0700 [INFO]: { 4: 27}: SADB_DELETE proto=255 src=10.250.30.50[0] dst=10.121.0.78[0] ESP spi=0xFC61DEB1 2026/08/04 15:18:12 2026-08-04 15:18:12.003 +0700 [DEBG]: processing isakmp packet 2026/08/04 15:18:12 2026-08-04 15:18:12.003 +0700 [DEBG]: === 2026/08/04 15:18:12 2026-08-04 15:18:12.003 +0700 [DEBG]: 80 bytes message received from 10.250.30.50 2026/08/04 15:18:12 2026-08-04 15:18:12.003 +0700 [DEBG]: { 4: }: [IKE Initiator] response message_id 34101 expected 34101 2026/08/04 15:18:12 2026-08-04 15:18:12.003 +0700 [DEBG]: { 4: }: response exch type 37 2026/08/04 15:18:12 2026-08-04 15:18:12.003 +0700 [DEBG]: { 4: }: update response message_id 0x8535 2026/08/04 15:18:12 2026-08-04 15:18:12.003 +0700 [INFO]: { 4: }: received DELETE payload, protocol ESP, num of SPI: 1 IKE SA state ESTABLISHED 2026/08/04 15:18:12 2026-08-04 15:18:12.003 +0700 [INFO]: { 4: }: delete proto ESP spi 0x9AD641EC 2026/08/04 15:18:12 2026-08-04 15:18:12.003 +0700 [PWRN]: { 4: }: can't find sa for proto ESP spi 0x9AD641EC 2026/08/04 15:18:12 2026-08-04 15:18:12.003 +0700 [DEBG]: processing isakmp packet 2026/08/04 15:18:12 2026-08-04 15:18:12.003 +0700 [DEBG]: === 2026/08/04 15:18:12 2026-08-04 15:18:12.003 +0700 [DEBG]: 80 bytes message received from 10.86.51.1 2026/08/04 15:18:12 2026-08-04 15:18:12.003 +0700 [DEBG]: { 1: }: [IKE Initiator] response message_id 2818 expected 2818 2026/08/04 15:18:12 2026-08-04 15:18:12.003 +0700 [DEBG]: { 1: }: response exch type 37 2026/08/04 15:18:12 2026-08-04 15:18:12.003 +0700 [DEBG]: { 1: }: update response message_id 0xb02 2026/08/04 15:18:13 2026-08-04 15:18:13.000 +0700 [PNTF]: { 4: 27}: ====> IPSEC KEY LIFETIME EXPIRED; tunnel ALTO-IPSEC-TUNNEL-DRC <==== 2026/08/04 15:18:13 ====> Expired SA: 10.121.0.78[500]-10.250.30.50[500] SPI:0x9DC44DCA/0x9AD6423B <==== 2026/08/04 15:18:13 2026-08-04 15:18:13.358 +0700 [DEBG]: processing isakmp packet 2026/08/04 15:18:13 2026-08-04 15:18:13.358 +0700 [DEBG]: === 2026/08/04 15:18:13 2026-08-04 15:18:13.358 +0700 [DEBG]: 272 bytes message received from 10.250.30.50 2026/08/04 15:18:13 2026-08-04 15:18:13.359 +0700 [DEBG]: { 4: }: [IKE Responder] request message_id 34105 expected 34105 2026/08/04 15:18:13 2026-08-04 15:18:13.359 +0700 [DEBG]: { 4: }: request exch type 36 2026/08/04 15:18:13 2026-08-04 15:18:13.359 +0700 [DEBG]: { 4: }: update request message_id 0x8539 2026/08/04 15:18:13 2026-08-04 15:18:13.359 +0700 [DEBG]: Parse Proposal: proposal #1 len=48 2026/08/04 15:18:13 2026-08-04 15:18:13.359 +0700 [PNTF]: { 4: }: ====> IKEv2 CHILD SA NEGOTIATION STARTED AS RESPONDER, non-rekey; gateway Alto-DRC <==== 2026/08/04 15:18:13 ====> Initiated SA: 10.121.0.78[500]-10.250.30.50[500] message id:0x00008539 parent SN:10069 <==== 2026/08/04 15:18:13 2026-08-04 15:18:13.359 +0700 [WARN]: { 4: 27}: selector ALTO-IPSEC-TUNNEL-DRC src is ambiguous, using the first one of the expanded addresses 2026/08/04 15:18:13 2026-08-04 15:18:13.359 +0700 [WARN]: { 4: 27}: selector ALTO-IPSEC-TUNNEL-DRC dst is ambiguous, using the first one of the expanded addresses 2026/08/04 15:18:13 2026-08-04 15:18:13.359 +0700 [DEBG]: { 4: 27}: TS matching for configured selector ALTO-IPSEC-TUNNEL-DRC 0.0.0.0[0]/0-0.0.0.0[0]/0 proto 0 2026/08/04 15:18:13 2026-08-04 15:18:13.359 +0700 [DEBG]: { 4: 27}: .. check local TS (num 1, TS0 is not specific) against selector 0:0.0.0.0[0]/0 2026/08/04 15:18:13 2026-08-04 15:18:13.359 +0700 [DEBG]: { : 27}: ... TS 0: 10.125.22.36->10.125.22.36[0-65535](ts) is used as it is narrower 2026/08/04 15:18:13 2026-08-04 15:18:13.359 +0700 [DEBG]: { 4: 27}: ... result: local TS < 0.0.0.0[0]/0 2026/08/04 15:18:13 2026-08-04 15:18:13.359 +0700 [DEBG]: { 4: 27}: .. check remote TS (num 1, TS0 is not specific) against selector 0:0.0.0.0[0]/0 2026/08/04 15:18:13 2026-08-04 15:18:13.359 +0700 [DEBG]: { : 27}: ... TS 0: 192.168.155.11->192.168.155.11[0-65535](ts) is used as it is narrower 2026/08/04 15:18:13 2026-08-04 15:18:13.359 +0700 [DEBG]: { 4: 27}: ... result: remote TS < 0.0.0.0[0]/0 2026/08/04 15:18:13 2026-08-04 15:18:13.359 +0700 [DEBG]: { 4: 27}: TS matching result: TS_l match(<), TS_r match(<) * 2026/08/04 15:18:13 2026-08-04 15:18:13.359 +0700 [DEBG]: { 4: 27}: selector chosen ALTO-IPSEC-TUNNEL-DRC: tid 27 2026/08/04 15:18:13 2026-08-04 15:18:13.359 +0700 [DEBG]: { 4: 27}: see whether there's matching transform 2026/08/04 15:18:13 2026-08-04 15:18:13.359 +0700 [DEBG]: { 4: 27}: found same ID(12,12). compare attributes 2026/08/04 15:18:13 2026-08-04 15:18:13.359 +0700 [DEBG]: ikev2_compare_attributes: Matched ENCR kenlen 256 2026/08/04 15:18:13 2026-08-04 15:18:13.359 +0700 [DEBG]: { 4: 27}: Matched ENCR: my [12], peer [12] 2026/08/04 15:18:13 OK; advance to next of my transform type 2026/08/04 15:18:15 2026-08-04 15:18:15.000 +0700 [PNTF]: { 4: 27}: ====> IPSEC KEY LIFETIME EXPIRED; tunnel ALTO-IPSEC-TUNNEL-DRC <==== 2026/08/04 15:18:15 ====> Expired SA: 10.121.0.78[500]-10.250.30.50[500] SPI:0x8C1EB246/0x9AD64247 <==== 2026/08/04 15:18:15 2026-08-04 15:18:15.000 +0700 [PNTF]: { 4: 27}: ====> IKEv2 CHILD SA DELETED AS RESPONDER, non-rekey; tunnel ALTO-IPSEC-TUNNEL-DRC <==== 2026/08/04 15:18:15 ====> Deleted SA: 10.121.0.78[500]-10.250.30.50[500] message id:0x00008538, SPI:0x8C1EB246/0x9AD64247 parent SN:10069 <==== 2026/08/04 15:18:15 2026-08-04 15:18:15.000 +0700 [INFO]: { 4: }: ikev2_request_initiator_start: SA state ESTABLISHED type 3 caller ikev2_child_delete 2026/08/04 15:18:15 2026-08-04 15:18:15.000 +0700 [INFO]: { 4: }: IKEv2 INFO transmit: gateway Alto-DRC, message_id: 0x00008537, type 3 SA state ESTABLISHED 2026/08/04 15:18:15 2026-08-04 15:18:15.000 +0700 [DEBG]: 10.121.0.78[500] - 10.250.30.50[500]:(nil) 1 times of 80 bytes message will be sent over socket 1024 2026/08/04 15:18:15 2026-08-04 15:18:15.000 +0700 [PNTF]: { 4: 27}: ====> IPSEC KEY DELETED; tunnel ALTO-IPSEC-TUNNEL-DRC <==== 2026/08/04 15:18:15 ====> Deleted SA: 10.121.0.78[500]-10.250.30.50[500] SPI:0x8C1EB246/0x9AD64247 <==== 2026/08/04 15:18:15 2026-08-04 15:18:15.000 +0700 [INFO]: { 4: 27}: SADB_DELETE proto=255 src=10.250.30.50[0] dst=10.121.0.78[0] ESP spi=0x8C1EB246 2026/08/04 15:18:15 2026-08-04 15:18:15.003 +0700 [DEBG]: processing isakmp packet 2026/08/04 15:18:15 2026-08-04 15:18:15.003 +0700 [DEBG]: === 2026/08/04 15:18:15 2026-08-04 15:18:15.003 +0700 [DEBG]: 80 bytes message received from 10.250.30.50 2026/08/04 15:18:15 2026-08-04 15:18:15.003 +0700 [DEBG]: { 4: }: [IKE Initiator] response message_id 34103 expected 34103 2026/08/04 15:18:15 2026-08-04 15:18:15.003 +0700 [DEBG]: { 4: }: response exch type 37 2026/08/04 15:18:15 2026-08-04 15:18:15.003 +0700 [DEBG]: { 4: }: update response message_id 0x8537 2026/08/04 15:18:15 2026-08-04 15:18:15.003 +0700 [INFO]: { 4: }: received DELETE payload, protocol ESP, num of SPI: 1 IKE SA state ESTABLISHED 2026/08/04 15:18:15 2026-08-04 15:18:15.003 +0700 [INFO]: { 4: }: delete proto ESP spi 0x9AD64247

I don't know if this is the reason why intermittent connection between our side and peer side.

Re: Intermittent IPsec connection

Raido_Rattameister — Wed, 05 Aug 2026 09:40:31 GMT

Continuous rekey can be caused by ProxyID(s) (encryption domain, TS) not matching.

Do you have 10.125.22.36/32 and 192.168.155.11/32 (and only this single one) at both sides?

Re: Intermittent IPsec connection

i.rifai — Wed, 05 Aug 2026 10:46:40 GMT

Hi, @Raido_Rattameister, thank you for pointing this out. We have tried to add remote IP 192.168.155.11/32 for Proxy ID and after that we did not found request timed out when pinging.
May I know why we need to setup Proxy ID in this case? I'm not really understand about Proxy ID, all I know is we need to use Proxy ID is the peer is using policy-based VPN.

Regards,
Moch. Imam Rifai

Re: Intermittent IPsec connection

Raido_Rattameister — Wed, 05 Aug 2026 11:38:53 GMT

Do you manage other side to check what subnets are in VPN policy?

You can switch Palo side to passive mode (in IKE gateway settings), initiate traffic from peer side so that Palo would be responder and then you see in logs what TS (ProxyID) peer side has configured. This allows to match Palo side to peer side.

topic Re: Intermittent IPsec connection in Next-Generation Firewall Discussions

Intermittent IPsec connection

Re: Intermittent IPsec connection

Re: Intermittent IPsec connection

Re: Intermittent IPsec connection