IPsec Phase 2 Lifesize Coutdown

Showing results for 
Show  only  | Search instead for 
Did you mean: 

IPsec Phase 2 Lifesize Coutdown

L2 Linker

On an Phase 2 IPsec SA with a non-zero lifesize, I see the proposed initial lifesize in the "show vpn ipsec-sa" output,

crclark@<redacted>-pa5050b(active)> show vpn ipsec-sa tunnel <redacted>-cisco-gw

GwID/client IP  TnID Peer-Address           Tunnel(Gateway)                                Algorithm     SPI(in)  SPI(out) life(Sec/KB)

--------------- ---- ------------           ---------------                                ---------     -------  -------- ------------

             16  190 <redacted>.4            <redacted>-cisco-gw:csx-net-<reda ESP/3DES/SHA1 AE3A4D8C 46E57EF1   1549/4608000

             16  191 <redacted>.4            <redacted>-cisco-gw:csx-net-<reda ESP/3DES/SHA1 CB4FE221 8B5EF149   1557/4608000

             16  194 <redacted>.4            <redacted>-cisco-gw:csx-net-<reda ESP/3DES/SHA1 911952E8 F67725C5   1535/4608000

             16  195 <redacted>.4            <redacted>-cisco-gw:csx-net-<re ESP/3DES/SHA1 DF7DA529 2899C3B7   1011/4608000

Show IPSec SA: Total 6 tunnels found. 4 ipsec sa found.

Unlike the lifetime, the lifesize is not decrementing as data goes over the tunnel. So I have two questions,

1) Where can I find the actual lifesize remaining on a tunnel?

2) Or does PAN-OS not actually track lifesize?


L1 Bithead

Try using this kb CLI Commands to Status, Clear, Restore, and Monitor an IPSEC VPN Tunnel show vpn flow tunnel-id X, but I'm not sure

L1 Bithead

show  vpn flow tunnel-id will show the lifetime remaining

Yes, it does show lifetime. I was looking for the lifesize. There is a mention of it in the flow output,

        packets received

          when lifetime expired:0

          when lifesize expired:0

But that's not about what the current lifesize counter is at. I guess you can use the encapsulated and decapsupated byte counts to figure it out.

L4 Transporter

Hello cosx,

Agree with you.  Life-size is the amount of data that the key can use for encryption and we do keep track of it being decremented so as to re-key once the lifesize limit is reached.

But just that it is not displayed unlike Life-time. Since it appears under IPsec crypto profiles, It can monitored through the ">show vpn ipsec-sa" command that you are already aware of.

I believe the only way for us to track it live would be through "encap bytes" under show vpn flow command.


Hi @tshiv,


Your explanation it's clear about life-size.

I have problem with a VPN Tunnel, for some reason peers involved are taking long time to re-establish it.

What does it means this one:


"lifetime 3600 Sec lifesize unlimited"


I can see this message in system logs; Can it cause issue when both peers are trying to re-negotiate VPN tunnel?

I need to configure a specific parameter for life-size?

Is that possible?


Thanks in advance

Best Regards



PS. Your image is the best that I ever seen on this community .. I'm Naruto's fan too haha 🙂 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!