IPsec VPN drops after 8 hours.

[kamrannaseem1]

Hello,

We have an IPsec VPN on Cisco ASA 9.6(2)  and it keeps dropping after 8 hours.

The other end is using Strong Swan. We have checked the phase 1 and phase 2 settings at both ends and they look ok.

Please see the attached logs and the phase 1 and phase 2 settings from cisco asa.

Any help will be much appreciated.

[Rahul Govindan]

8 hours is the default lifetime for the Phase 2 tunnel. It could be possible that the rekey process, which is supposed to take place before that 8 hour time comes about, is failing with Strongswan. 

There seems to have been an issue with Strongswan more than a year ago as detailed on this link:

https://wiki.strongswan.org/issues/1293

You might want to run the following debugs on the ASA some time before the 8 hour time period to get some more info on what is failing:

debug crypto ikev2 protocol 127
debug crypto ikev2 platform 127

[kamrannaseem1]

Thank you Rahul,

Please see the attached debugs.

[kamrannaseem1]

Hi Rahul,

Did you manage to spot any issue as per the debug info provided ?