we experiencing S2S VPN connection issues, it's often drops for no reason almost every day in a week. There are 30+ other S2S VPN to other customers on our side which work perfectly well.
In case of the bad-working VPN we suspect a Lifetimers mismatch on both side. So, I have 4 question:
0) Am I right, that in Phase 1 Lifetime values should 100% match on both sides, but in Phase 2 they can be different?
1) Could different timer values for Phase2 be a reason for the connection drops?
2) If, say, for Phase 2 they have 28800 on their side, and I have 3600 on my side - whose value will be used? Would it be eventually same value for both sides, or the sides would use different ones?
3) Where can I see actually used Phase1 Lifetime timers?
Now I have a task to check Lifetime timers for the connection, so I am bit confused how to find it out properly.
In Phase 2 we have:
crypto map outside_map 55 set security-association lifetime seconds 3600. That's easy - 3600
but what is about the Phase 1?
show crypto isakmp sa gives me:
Type : L2L Role : initiator
Rekey : no State : MM_ACTIVE
Encrypt : aes-256 Hash : SHA
Auth : preshared Lifetime: 28800
Lifetime Remaining: 9112
Is it really a the Lifetime value used in Phase 1?
We have a lot of "crypto ikev1 policy X", where X is 10, 20, 30, ...200 with same AUTH/ENC/GRP settings, but different Lifetime values set.
How may I see what Policy (number) is used by the particular connection?
Thank you very much in advance,
Solved! Go to Solution.