2

Good day

I was hoping someone has seen this before, I have a ASA5520 that has a l2l tunnel to a Palo Alto firewall. Every 2 mins the the logs I see a rekey I have check our configuration and we have everything exactly the same. I did find in my crypto map that for the ikev2 proposal I am pointing to the wrong one, it is slightly different in that the one that it is currently pointing to has the integrity as sha-1 md5 but it should be pointing to the one that only has sha-1. I am hoping that that is the cause of the rekeying but just in case anyone ever seen this before?

Thank you in advance!!!

Improve this question
3
  • Can you please share lifetime settings on both ends?
    – user5337995
    May 8, 2019 at 4:06
  • crypto ikev2 policy 50 encryption aes-256 integrity sha group 2 prf sha lifetime seconds 28800
    – Warren
    May 8, 2019 at 13:30
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Dec 15, 2019 at 2:29

1 Answer 1

Reset to default
2

Ok so we have fixed the issue, so for anyone having this similar issue where your tunnel rekeys every 2 mins. Here is the situation your ASA version is PRE-9.7 and in my case I am connecting to a Palo Alto. On the Palo Alto side they will need to, on the IPSEC tunnel enable "PROXY ID" that will fix the rekeying issue

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.