GETVPN REKEYING not correct

[asabagh]

Hi,

I am really confused. The Key Server is configured to rekey every 12 hours (43200 Seconds). This is the part of configuraiton :

crypto ipsec profile gdoi-profile-getvpn
set security-association lifetime seconds 43200
set transform-set mygdoi-trans

However, after almost 24 hours, we notice that rekeying is hapenning every 2 hours :

GETVPN-KS1#show crypto gdoi ks members

Group Member Information :

Number of rekeys sent for group getvpn : 404

Group Member ID   : 10.0.50.25
Group ID          : 1234
Group Name        : getvpn
Key Server ID     : 10.0.50.27
Rekeys sent       : 12
Rekeys retries    : 0
Rekey Acks Rcvd   : 12
Rekey Acks missed : 0

Sent seq num :    11    12    13    0
Rcvd seq num :    11    12    13    0

and this is capture of the GM log:

*Apr  5 08:40:43: %GDOI-5-GM_RECV_REKEY: Received Rekey for group getvpn from 10.0.50.27 to 10.0.50.25 with seq # 2
*Apr  5 10:40:42: %GDOI-5-GM_RECV_REKEY: Received Rekey for group getvpn from 10.0.50.27 to 10.0.50.25 with seq # 3
*Apr  5 12:40:42: %GDOI-5-GM_RECV_REKEY: Received Rekey for group getvpn from 10.0.50.27 to 10.0.50.25 with seq # 4
*Apr  5 14:40:42: %GDOI-5-GM_RECV_REKEY: Received Rekey for group getvpn from 10.0.50.27 to 10.0.50.25 with seq # 5
*Apr  5 16:40:42: %GDOI-5-GM_RECV_REKEY: Received Rekey for group getvpn from 10.0.50.27 to 10.0.50.25 with seq # 6
*Apr  5 18:24:16: %GDOI-5-GM_RECV_REKEY: Received Rekey for group getvpn from 10.0.50.27 to 10.0.50.25 with seq # 7
*Apr  5 20:24:16: %GDOI-5-GM_RECV_REKEY: Received Rekey for group getvpn from 10.0.50.27 to 10.0.50.25 with seq # 8
*Apr  5 22:24:16: %GDOI-5-GM_RECV_REKEY: Received Rekey for group getvpn from 10.0.50.27 to 10.0.50.25 with seq # 9
*Apr  6 00:24:16: %GDOI-5-GM_RECV_REKEY: Received Rekey for group getvpn from 10.0.50.27 to 10.0.50.25 with seq # 10
*Apr  6 02:24:16: %GDOI-5-GM_RECV_REKEY: Received Rekey for group getvpn from 10.0.50.27 to 10.0.50.25 with seq # 11
*Apr  6 04:24:16: %GDOI-5-GM_RECV_REKEY: Received Rekey for group getvpn from 10.0.50.27 to 10.0.50.25 with seq # 12
*Apr  6 05:10:51: %GDOI-5-GM_RECV_REKEY: Received Rekey for group getvpn from 10.0.50.27 to 10.0.50.25 with seq # 13

It doesn't make sence. Why ??

[Bastien Migette]

IPSEC SA Lifetime is in second or in kiloBytes, first of the two. You might check with show crypto ipsec sa

example:

     inbound esp sas:
       spi: 0xFDC7B87B(4257724539)
         transform: esp-256-aes ,
         in use settings ={Tunnel, }
         conn id: 2004, flow_id: SW:4, crypto map: MyMap
        sa timing: remaining key lifetime (k/sec): (4565647/146)

The data lifetime is as well configurable:

crypto ipsec security-association lifetime ?
  kilobytes  Volume-based key duration
  seconds    Time-based key duration

you may check as well GDOI rekey lifetime

R1#sh crypto gdoi group gd
    Group Name               : gd (Multicast)
    Group Identity           : unknown id type
    Group Members            : 0
    IPSec SA Direction       : Both
    Group Rekey Lifetime     : 86400 secs
    Rekey Retransmit Period  : 10 secs

configurable under

crypto gdoi group XXX

server local

   rekey lifetime xxx

[asabagh]

Hi,

The TEK is configured correctly, and the show crypto gdoi shows the correct remaining lifetime

TEK POLICY for the current KS-Policy ACEs Downloaded:
  GigabitEthernet0/1:
  GigabitEthernet0/2:
    IPsec SA:
        spi: 0x417DC00B(1098760203)
        transform: esp-aes esp-sha-hmac
        sa timing:remaining key lifetime (sec): (21711)
        Anti-Replay(Time Based) : 5 sec interval

    IPsec SA:

        spi: 0x11B8C3E5(297321445)

        transform: esp-aes esp-sha-hmac

       sa timing:remaining key lifetime (sec): (39531)

        Anti-Replay(Time Based) : 5 sec interval

the router is not actually following the lifetime but rather keeps rekeying every two hours.

[Ishaan Sanji]

Hi Amro,

It looks like you have enabled TBAR as oart of your setup. If TBAR is enabled then the re-key will happen every two hours no matter what you set as your rekey timer. This is for clock synchronization on all devices.

If you disable TBAR then the rekey will happen as per your configured value.