Hi V,
note that your ISAKMP policy has "lifetime 3600" which means your ISAKMP SA will only be valid for one hour, so the client will initiate a new ISAKMP (phase 1) session a 'short' time before the current one expires. How much time depends on some differnet factors but around 40-50 mins seems quite normal, 20 minutes is strange.
Usually there is no need to set the isakmp (phase 1) lifetime so low - 8h or even 24h should be ok. Note that you still have a phase 2 rekey every hour (with default settings) so the ISAKMP keying material (sort of the "master key") will change only once every 8 or 24h but the actual encryption key will still change every hour (or rather, every 48mins or so).
If you still see any behavior that is not consistent with this explanation (e.g. re-auth after 20 mins, or the time between re-auths doesnt change when you increase the lifetime) then have a look at the client logs to see if there is a clue as to why it is doing that. Increase the log level detail as follows:
- close the client
- edit the vpnclient.ini file
- change all LogLevel entries to 15
- save the file
- open the client again and don't touch the log levels
hth
Herbert
--
If this post answers your question, please click the "Correct Answer" button
