Help! Weird lifetime vs. lifetime remaining on VPN tunnel...

[Sal Robertson]

I am getting a seriously bizarre set of results here...

8   IKE Peer: <peer IP>

    Type    : L2L             Role    : responder

    Rekey   : no              State   : MM_WAIT_MSG5

    Encrypt : 3des            Hash    : SHA

    Auth    : preshared       Lifetime: 28800

    Lifetime Remaining: 2147480830

Any ideas?!

crypto isakmp policy 16

authentication pre-share

encryption 3des

hash md5

group 1

lifetime 86400

[Marcin Latosiewicz]

Sal,

In this case the IKE exchange is not yet finished, (State   : MM_WAIT_MSG5) does that persist for established IKE sessions?

M.

[Sal Robertson]

It does not.

[Marcin Latosiewicz]

Then it is most likely expected, it could be there to facilitate things like responder_lifetime messages etc.

One other note the IKE policy you've indicated is 3DES & MD5 while you can see that the negotiated one is 3DES & SHA.

[Sal Robertson]

That would be me referencing the wrong policy.

crypto isakmp policy 1

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400