IKEv2 keepalive tuning

nikoo — Fri, 07 Aug 2020 11:05:56 GMT

IKEv2 on PA has built in keepalive mechanism, but it can only act if the communication is lost for more than 5 minutes: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClgcCAC

After testing it out, about 7-8 minutes passed until Palo Alto detected lost peer and did reset of the tunnel.

That's happening due to built in algorithm:

The default interval of liveness checking is every 5 seconds when SA is idle. Upon losing connection, the firewall will do 10 liveness retries with increasing timeout (seconds) for each retry as follows:

1 + 2 + 4 + 8 + 16 + 32 + 64 + 64 + 64 + 64 = 319 seconds (about 5 minutes)

.. meaning it is not configurable in any way? Is there a way to speed it up?

Tunnel monitoring didn't seem to be an option, because tunnel is proxyID based and there are 4 proxyIDs configured - tunnel monitoring was working properly for one of them (source/destination pair), but at the same time concluded that other 3 of them are down and did the reset every 10 seconds or so which is not acceptable.

Basically, what are your options to detect the IPSec tunnel peer down condition and act as soon as possible, meaning, tear down the tunnel and start re-negotiation.

Re: IKEv2 keepalive tuning

BPry — Fri, 07 Aug 2020 12:46:41 GMT

@nikoo,

@nikoo wrote:
Basically, what are your options to detect the IPSec tunnel peer down condition and act as soon as possible, meaning, tear down the tunnel and start re-negotiation.

Scripting and the API.

The best way that I've found to deal with something like this is having something on each end (can be as dumb as a raspberry pi) which is simply performing a basic ICMP check via a scheduled script. If the script notices a tunnel is down, then it goes out and clears the connection and starts a test to bring things back online and make it functional in the shortest timeframe possible.

The benefit of this type of solution is that the ICMP check itself in a lot of cases will cause enough traffic to keep all of the tunnels online baring an actual connectivity issue.

topic Re: IKEv2 keepalive tuning in General Topics

IKEv2 keepalive tuning

Re: IKEv2 keepalive tuning