Who Me Too'd this topic

We received a report of some connectivity issues with an IPSEC tunnel between a Palo 5220 (9.1.8) and Azure VNG

Looking at this deeper, we see an odd rekey pattern happening with the IPSEC Rekey.  Every 4th rekey is a non-rekey and occurs short.  Can anyone help us understand what could possibly be causing this?  Its happening only on Azure VPN tunnels (multiple).

In the detail log of this rekey we see this:  Note: the first message, this is only seen on a short rekey (non-rekey)

{ 3: }: test-vpn-azure: IKEv2 SA test initiate start.
{ 3: }: ====> IKEv2 IKE SA NEGOTIATION STARTED AS INITIATOR, non-rekey; gateway test-vpn-azure <====
====> Initiated SA: x.x.x.x[500]-x.x.x.x[500] SPI:c8d0792b57f54007:0000000000000000 SN:1382 <====
{ 3: }: x.x.x.x[500] - x.x.x.x[500]:0x7f80364df7d0 ignoring notification payload (type NAT_DETECTION_SOURCE_IP) inside unauthenticated response
{ 3: }: x.x.x.x[500] - x.x.x.x[500]:0x7f80364df7d0 ignoring notification payload (type NAT_DETECTION_DESTINATION_IP) inside unauthenticated response
{ 3: }: x.x.x.x[500] - x.x.x.x[500]:0x7f80364df7d0 vendor id payload ignored
{ 3: }: x.x.x.x[500] - x.x.x.x[500]:0x7f80364df7d0 vendor id payload ignored
{ 3: }: ====> IKEv2 CHILD SA NEGOTIATION STARTED AS INITIATOR, non-rekey; gateway test-vpn-azure <====
====> Initiated SA: x.x.x.x[500]-x.x.x.x[500] message id:0x00000000 parent SN:1382 <====
{ 3: }: x.x.x.x[500] - x.x.x.x[500]:0x7f8020018720 authentication result: success
{ 3: 42}: SADB_UPDATE proto=255 x.x.x.x[500]=>x.x.x.x[500] ESP tunl spi 0x9683CEAB auth=NON-AUTH enc=AES256-GCM16/36 lifetime soft 22932/0 hard 27000/0
{ 3: 42}: SADB_ADD proto=255 x.x.x.x[500]=>x.x.x.x[500] ESP tunl spi 0x2CE69680 auth=NON-AUTH enc=AES256-GCM16/36 lifetime soft 22161/0 hard 27000/0
{ 3: 42}: ====> IPSEC KEY INSTALLATION SUCCEEDED; tunnel test-vpn-azure <====
====> Installed SA: x.x.x.x[500]-x.x.x.x[500] SPI:0x9683CEAB/0x2CE69680 lifetime 27000 Sec lifesize unlimited <====
{ 3: 42}: ====> IKEv2 CHILD SA NEGOTIATION SUCCEEDED AS INITIATOR, non-rekey; tunnel test-vpn-azure <====
====> Established SA: x.x.x.x[500]-x.x.x.x[500] message id:0x00000001, SPI:0x9683CEAB/0x2CE69680 parent SN:1382 <====
{ 3: }: ====> IKEv2 IKE SA NEGOTIATION SUCCEEDED AS INITIATOR, non-rekey; gateway test-vpn-azure <====
====> Established SA: x.x.x.x[500]-x.x.x.x[500] SPI:c8d0792b57f54007:0a2d7efeeb1193e1 SN:1382 lifetime 28800 Sec <====
{ 3: }: === reauth: SA 1363 is to be replaced ===
{ 3: 42}: child SA has been replaced by 5748235
{ 3: 42}: child SA has been replaced, skip
{ 3: }: child SA state EXPIRED, skip
{ 3: }: no more child SA to be renegotiated
{ 3: }: remove duplicate IKE SA, sn 1363
{ 3: }: received DELETE payload, protocol ESP, num of SPI: 1 IKE SA state ESTABLISHED
{ 3: }: delete proto ESP spi 0x6EE318D4
{ 3: 42}: ====> IPSEC KEY DELETED; tunnel test-vpn-azure <====
====> Deleted SA: x.x.x.x[500]-x.x.x.x[500] SPI:0xCD0C0EC3/0x6EE318D4 <====
{ 3: 42}: SADB_DELETE proto=255 src=x.x.x.x[0] dst=x.x.x.x[0] ESP spi=0xCD0C0EC3
{ 3: 42}: SPI 9683CEAB inserted by IKE-SA rekey, return 0 0.
{ 3: 42}: SPI CD0C0EC3 removed by IKE SA delete, return 0 0.
{ 3: }: received DELETE payload, gateway test-vpn-azure SA state ESTABLISHED, SPI fdbd7849a0b8df4c:f1ddca2cbbb7576c
{ 3: }: x.x.x.x[500] - x.x.x.x[500]:(nil) closing IKEv2 SA test-vpn-azure:1363, code 7