Frequent re-keying of ipsec tunnels

PatrickWalton — Fri, 13 May 2016 17:54:35 GMT

When I look under Monitor -> Logs -> System, I see the following:

1. ipsec-key-delete: IPSec key deleted. Deleted SA <SA info> SPI:<hex dump>

2. ike-nego-p2-succ: IKE phase-2 negotiation is succeeded as responder, quick mode. Established SA <SA info> SPI: <hex dump>

3. ipsec-key-install: IPSec key installed. Installed SA <SA info> SPI: <hex dump>

We have several site to site tunnels on this firewall, some of them with multiple proxy id's. If I filter based on one specific proxy id, I see it going through this process frequently. Sometimes it is multiple times per minute, sometimes it goes ~5 minutes or so. The same occurs for numerous other proxy id's.

Is this something to be concerned about? It seems that I'm receiving delete messages that correspond to this behavior:

ike-recv-p2-delete: IKE protocol IPSec SA delete message received from peer. SPI: <hex dump>

Re: Frequent re-keying of ipsec tunnels

glastra1 — Wed, 18 May 2016 03:57:34 GMT

Phase 2 (Each proxy ID) should be negotiated according to the key lifetime, so if in one side it's set to 5 minutes that's normal. You don't usually want to re-ley that often, if you're receiving delete messages the re-keys need to be troubleshooted in the side deleting the SA. If the other side it's also a palo alto a rekey can be triggered if tunnel monitoring is detected as "down",

https://live.paloaltonetworks.com/t5/Configuration-Articles/Understanding-behavior-of-PBF-and-Tunnel-monitoring-probes/ta-p/68666

You can check the remaining lifetime for your Phases 2 with the following command,

>show vpn flow.

Regards,

Gerardo.

topic Frequent re-keying of ipsec tunnels in General Topics

Frequent re-keying of ipsec tunnels

Re: Frequent re-keying of ipsec tunnels