ipsec debugging

Alex_Samad — Fri, 03 Jan 2020 02:58:41 GMT

I have a ipsec tunnel with a vendor - they use cisco on their end.

I have been advise IKE and ESP lifespan is 8 hours ... 28800 sec

But what I have noticed is if I set it to this around 6 hours in traffic stops passing.

I have to restart the tunnel - via the gui to bring it back.

I have tried setting lifespan to 6 hours on my side , but i get alerts with VPN down VPN up - critial. which is annoying

What I would like to know is there a way to force a rekey via the CLI - and also how to stop and start the VPN via the CLI.

I want to do a rekey (force) so i can check if that is working.

Re: ipsec debugging

kiwi — Fri, 03 Jan 2020 13:48:20 GMT

Hi @Alex_Samad ,

I'd test with the following commands :

clear vpn ike-sa (remove active IKE SA and abort all ongoing key negotiation) clear vpn ipsec-sa (deactivate IPSec SA) test vpn ipsec-sa tunnel <name>

Here's the article that might help you:

HOW TO CHECK STATUS, CLEAR, RESTORE, AND MONITOR AN IPSEC VPN TUNNEL

Hope it helps !

Cheers !

-Kiwi.

topic ipsec debugging in General Topics

ipsec debugging

Re: ipsec debugging