ipsec debugging

[Alex_Samad]

Hi

I have a ipsec tunnel with a vendor - they use cisco on their end.

I have been advise IKE and ESP lifespan is 8 hours ... 28800 sec

But what I have noticed is if I set it to this around 6 hours in traffic stops passing.

I have to restart the tunnel - via the gui to bring it back.

I have tried setting lifespan to 6 hours on my side , but i get alerts with VPN down VPN up - critial. which is annoying

What I would like to know is there a way to force a rekey via the CLI - and also how to stop and start the VPN via the CLI.

I want to do a rekey (force) so i can check if that is working.

A

[kiwi · Accepted solution]

Hi @Alex_Samad ,

I'd test with the following commands :

clear vpn ike-sa (remove active IKE SA and abort all ongoing key negotiation)
clear vpn ipsec-sa (deactivate IPSec SA) 
test vpn ipsec-sa tunnel <name> 

Here's the article that might help you:

HOW TO CHECK STATUS, CLEAR, RESTORE, AND MONITOR AN IPSEC VPN TUNNEL 

Hope it helps !

Cheers !

-Kiwi.