05-13-2016 10:54 AM
When I look under Monitor -> Logs -> System, I see the following:
1. ipsec-key-delete: IPSec key deleted. Deleted SA <SA info> SPI:<hex dump>
2. ike-nego-p2-succ: IKE phase-2 negotiation is succeeded as responder, quick mode. Established SA <SA info> SPI: <hex dump>
3. ipsec-key-install: IPSec key installed. Installed SA <SA info> SPI: <hex dump>
We have several site to site tunnels on this firewall, some of them with multiple proxy id's. If I filter based on one specific proxy id, I see it going through this process frequently. Sometimes it is multiple times per minute, sometimes it goes ~5 minutes or so. The same occurs for numerous other proxy id's.
Is this something to be concerned about? It seems that I'm receiving delete messages that correspond to this behavior:
ike-recv-p2-delete: IKE protocol IPSec SA delete message received from peer. SPI: <hex dump>
05-17-2016 08:57 PM
Phase 2 (Each proxy ID) should be negotiated according to the key lifetime, so if in one side it's set to 5 minutes that's normal. You don't usually want to re-ley that often, if you're receiving delete messages the re-keys need to be troubleshooted in the side deleting the SA. If the other side it's also a palo alto a rekey can be triggered if tunnel monitoring is detected as "down",
You can check the remaining lifetime for your Phases 2 with the following command,
>show vpn flow.
Regards,
Gerardo.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
