2

Good day

I was hoping someone has seen this before, I have a ASA5520 that has a l2l tunnel to a Palo Alto firewall. Every 2 mins the the logs I see a rekey I have check our configuration and we have everything exactly the same. I did find in my crypto map that for the ikev2 proposal I am pointing to the wrong one, it is slightly different in that the one that it is currently pointing to has the integrity as sha-1 md5 but it should be pointing to the one that only has sha-1. I am hoping that that is the cause of the rekeying but just in case anyone ever seen this before?

Thank you in advance!!!

  • Can you please share lifetime settings on both ends? – user5337995 May 8 at 4:06
  • crypto ikev2 policy 50 encryption aes-256 integrity sha group 2 prf sha lifetime seconds 28800 – Warren May 8 at 13:30
2

Ok so we have fixed the issue, so for anyone having this similar issue where your tunnel rekeys every 2 mins. Here is the situation your ASA version is PRE-9.7 and in my case I am connecting to a Palo Alto. On the Palo Alto side they will need to, on the IPSEC tunnel enable "PROXY ID" that will fix the rekeying issue

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.