Site to site VPN issue

[darren_g]

Folks.

I have an issue with some site-to-site configurations that is bugging the cr*p out of me, and I thought I'd post it here.

I run some site-to-site VPN's (Palo Alto to Cisco 887 routers) which come up fine, but which seem to defy *all* configuration with respect to IpSec SA lifetime.

As far as I can tell, I've configured a 12 hour (43200 second) lifetime, yet when the IPSec is negotiated, I get this in the logs.

IPSec key installed. Installed SA: www.xxx.yyy.zzz[500]-aaa.bbb.ccc.ddd[500] SPI:0x8AA8C96C/0x49847307 lifetime 3600 Sec lifesize 4608000 KB.

Note the "3600 Sec" lifetime - which is only 1 hour.

Now, this is not a real big deal - apart from adding extra lines into my logs, it's not a real hassle - but it's just peeving me off that I can't solve it.

Is there anywhere else I should look for lifetime settings besides the "IPSec Crypto" setting int he network configuration?

Thanks

[darren_g · Accepted solution]

Never mind, found the issue - had to tweak the Cisco end a bit to get it to accept the additional time frame parameters.

All good now. No more excessive log entries!