Multiple IPSec SAs (Security Associations) show up for the same VPN.
A site-to-site VPN has been configured, but sometimes multiple SAs (Security Associations) are seen for the same VPN. Is this a bug?
root@ff-lab-095> show security ipsec sa index 131100 ID: 131100 Virtual-system: root, VPN Name: lab37 Local Gateway: 172.24.245.38, Remote Gateway: 10.0.0.1 Local Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0) Remote Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0) Version: IKEv2 DF-bit: clear Bind-interface: st0.37 Port: 4500, Nego#: 631, Fail#: 0, Def-Del#: 0 Flag: 0x600a29 Last Tunnel Down Reason: Delete payload received Direction: inbound, SPI: ac0b3af8, AUX-SPI: 0 , VPN Monitoring: - Hard lifetime: Expired Lifesize Remaining: Expired Soft lifetime: Expired Mode: Tunnel(0 0), Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc (128 bits) Anti-replay service: counter-based enabled, Replay window size: 64 Direction: outbound, SPI: 825009a3, AUX-SPI: 0 , VPN Monitoring: - Hard lifetime: Expired Lifesize Remaining: Expired Soft lifetime: Expired Mode: Tunnel(0 0), Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc (128 bits) Anti-replay service: counter-based enabled, Replay window size: 64 Direction: inbound, SPI: 98e92cb5, AUX-SPI: 0 , VPN Monitoring: - Hard lifetime: Expires in 3599 seconds Lifesize Remaining: Unlimited Soft lifetime: Expires in 2960 seconds Mode: Tunnel(0 0), Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc (128 bits) Anti-replay service: counter-based enabled, Replay window size: 64 Direction: outbound, SPI: 82fa5409, AUX-SPI: 0 , VPN Monitoring: - Hard lifetime: Expires in 3599 seconds Lifesize Remaining: Unlimited Soft lifetime: Expires in 2960 seconds Mode: Tunnel(0 0), Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc (128 bits) Anti-replay service: counter-based enabled, Replay window size: 64
This is not a bug. This is by design in order to ensure a smooth transition between the old and new P2 negotiation. The previous negotiation will be kept for a few seconds to prevent traffic loss.
Just before expiration of the Soft Lifetime we see just one set of P2 SAs:
root@ff-lab-095> show security ipsec sa index 131100 ID: 131100 Virtual-system: root, VPN Name: lab37 Local Gateway: 172.24.245.38, Remote Gateway: 10.0.0.1 Local Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0) Remote Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0) Version: IKEv2 DF-bit: clear Bind-interface: st0.37 Port: 4500, Nego#: 630, Fail#: 0, Def-Del#: 0 Flag: 0x600a29 Last Tunnel Down Reason: Delete payload received Direction: inbound, SPI: ac0b3af8, AUX-SPI: 0 , VPN Monitoring: - Hard lifetime: Expires in 632 seconds Lifesize Remaining: Unlimited Soft lifetime: Expires in 2 seconds Mode: Tunnel(0 0), Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc (128 bits) Anti-replay service: counter-based enabled, Replay window size: 64 Direction: outbound, SPI: 825009a3, AUX-SPI: 0 , VPN Monitoring: - Hard lifetime: Expires in 632 seconds Lifesize Remaining: Unlimited Soft lifetime: Expires in 2 seconds Mode: Tunnel(0 0), Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc (128 bits) Anti-replay service: counter-based enabled, Replay window size: 64
When the Soft Lifetime expires, the old negotiation is marked as Expired, but kept for a few seconds for a smooth transition from the previous set of SPIs to the new set opf SPIs.
root@ff-lab-095> show security ipsec sa index 131100 ID: 131100 Virtual-system: root, VPN Name: lab37 Local Gateway: 172.24.245.38, Remote Gateway: 10.0.0.1 Local Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0) Remote Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0) Version: IKEv2 DF-bit: clear Bind-interface: st0.37 Port: 4500, Nego#: 631, Fail#: 0, Def-Del#: 0 Flag: 0x600a29 Last Tunnel Down Reason: Delete payload received Direction: inbound, SPI: ac0b3af8, AUX-SPI: 0 <<<< Old SPI , VPN Monitoring: - Hard lifetime: Expired Lifesize Remaining: Expired Soft lifetime: Expired Mode: Tunnel(0 0), Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc (128 bits) Anti-replay service: counter-based enabled, Replay window size: 64 Direction: outbound, SPI: 825009a3, AUX-SPI: 0 <<<< Old SPI , VPN Monitoring: - Hard lifetime: Expired Lifesize Remaining: Expired Soft lifetime: Expired Mode: Tunnel(0 0), Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc (128 bits) Anti-replay service: counter-based enabled, Replay window size: 64 Direction: inbound, SPI: 98e92cb5, AUX-SPI: 0 <<<< New SPI , VPN Monitoring: - Hard lifetime: Expires in 3599 seconds Lifesize Remaining: Unlimited Soft lifetime: Expires in 2960 seconds Mode: Tunnel(0 0), Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc (128 bits) Anti-replay service: counter-based enabled, Replay window size: 64 Direction: outbound, SPI: 82fa5409, AUX-SPI: 0 <<<< New SPI , VPN Monitoring: - Hard lifetime: Expires in 3599 seconds Lifesize Remaining: Unlimited Soft lifetime: Expires in 2960 seconds Mode: Tunnel(0 0), Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc (128 bits) Anti-replay service: counter-based enabled, Replay window size: 64
A few seconds later, the Expired P2 is removed. It does not wait for the Hard Lifetime to expire.
root@ff-lab-095> show security ipsec sa index 131100 ID: 131100 Virtual-system: root, VPN Name: lab37 Local Gateway: 172.24.245.38, Remote Gateway: 10.0.0.1 Local Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0) Remote Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0) Version: IKEv2 DF-bit: clear Bind-interface: st0.37 Port: 4500, Nego#: 631, Fail#: 0, Def-Del#: 0 Flag: 0x600a29 Last Tunnel Down Reason: Lifetime expired Direction: inbound, SPI: 98e92cb5, AUX-SPI: 0 , VPN Monitoring: - Hard lifetime: Expires in 3594 seconds Lifesize Remaining: Unlimited Soft lifetime: Expires in 2955 seconds Mode: Tunnel(0 0), Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc (128 bits) Anti-replay service: counter-based enabled, Replay window size: 64 Direction: outbound, SPI: 82fa5409, AUX-SPI: 0 , VPN Monitoring: - Hard lifetime: Expires in 3594 seconds Lifesize Remaining: Unlimited Soft lifetime: Expires in 2955 seconds Mode: Tunnel(0 0), Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc (128 bits) Anti-replay service: counter-based enabled, Replay window size: 64
When a Soft Lifetime expires, a message is sent to the IPSec process that the SA is about to expire. To avoid any drop in the traffic the device initiates a new SA. It is at that time we see multiple SA for the same VPN. When the first SA expires, since the new SA is already negotiated all the traffic starts flowing through the other SA and avoids any drop in traffic.
Hard Lifetime : The value for this is taken from the configuration, with a default value of 3600 seconds. When this lifetime counts to zero the SA expires. Soft Lifetime : The value is derived from the hard lifetime. It is approximately 5/6 of the hard lifetime with a random element to help prevent simultaneous rekeys, as opposed to ScreenOS which had a manually configurable modifier for the lifetime buffer. For the default 3600 you should expect to see the following: Hard lifetime: 3600 seconds. Soft lifetime: approximately 2900 - 3100 seconds.
Hard lifetime: 3600 seconds. Soft lifetime: approximately 2900 - 3100 seconds.
2020-10-07: Minor, non-technical edits.