Description

The VPN connection is considered active when the first IKE Phase 1 SA establishes. It is considered gone when:

  • All IKE Phase 1 has expired
    AND
  • Hold time (10 minutes) passed after the lifetime of the last IPSec SA expired which ever happens last.

Symptoms

The output of the following commands shows an example where the IKE active peer information is cleared: IKE active-peer information exists even though Phase 1 SA and Phase 2 SA are expired.

lab> show security ike active-peer
Remote Address Port Peer IKE-ID XAUTH username Assigned IP
30.1.1.2       500  testtest

lab> show security ipsec security-associations
Total active tunnels: 0

lab> show security ike security-associations

Solution

The phenomenon is an expected behavior.

IKE active peer information is cleared when all IKE Phase 1 SA have expired and the hold time (10 minutes) has passed after the lifetime of the last IPSec SA (Phase 2 SA) expired, whichever happens last.

Thus IKE active peer information could still exist even Phase 1 SA and Phase 2 SA is expired.

The logs below show when the IKE active peer information is cleared.

  1. A client is connected. In this example, the client didn't click disconnect explicitly, but just disconnected from the network. If the client clicked disconnect, the Phase 2 SA information would be deleted.

    lab> show system uptime | match Current
    Current time: 2011-03-17 15:24:13 UTC

    lab> show security ike active-peer
    Remote Address Port Peer IKE-ID XAUTH username Assigned IP
    30.1.1.2 500 testtest

    lab> show security ipsec security-associations
    Total active tunnels: 1
    ID Gateway Port Algorithm SPI Life:sec/kb Mon vsys
    <133955592 30.1.1.2 500 ESP:3des/md5 5b78bf9f 180/ 15000 - root
    >133955592 30.1.1.2 500 ESP:3des/md5 4e4184a6 180/ 15000 - root

    lab> show security ike security-associations
    Index Remote Address State Initiator cookie Responder cookie Mode
    4607 30.1.1.2 UP b933c309748a8549 939435b297cee140 Aggressive

    lab> show system license
    License usage:
    Licenses Licenses Licenses Expiry
    Feature name used installed needed
    idp-sig 0 1 0 2012-03-13 00:00:00 UTC
    dynamic-vpn 1 10 0 permanent
    ax411-wlan-ap 0 2 0 permanent

  2. Phase 1 SA has expired:

    lab> show system uptime | match Current Current time: 2011-03-17 15:26:10 UTC

    lab> show security ike active-peer
    Remote Address Port Peer IKE-ID XAUTH username Assigned IP
    30.1.1.2 500 testtest

    lab> show security ipsec security-associations
    Total active tunnels: 1
    ID Gateway Port Algorithm SPI Life:sec/kb Mon vsys
    <133955592 30.1.1.2 500 ESP:3des/md5 5b78bf9f 63/ 13500 - root
    >133955592 30.1.1.2 500 ESP:3des/md5 4e4184a6 63/ 13500 - root

    lab> show security ike security-associations     ---> Phase 1 SA expired.

  3. Phase 2 SA expired.

    lab> show system uptime | match Current Current time: 2011-03-17 15:27:13 UTC

    lab> show security ike active-peer
    Remote Address Port Peer IKE-ID XAUTH username Assigned IP
    30.1.1.2 500 testtest

    lab> show security ipsec security-associations ---> Phase 2 SA expired.
    Total active tunnels: 0

    lab> show security ike security-associations

    lab> show system license
    License usage:
    Licenses Licenses Licenses Expiry
    Feature name used installed needed
    idp-sig 0 1 0 2012-03-13 00:00:00 UTC
    dynamic-vpn 0 10 0 permanent
    ax411-wlan-ap 0 2 0 permanent

  4. After 10 minutes since the Phase 2 SA expired:

    lab> show system uptime | match Current
    Current time: 2011-03-17 15:37:14 UTC

    lab> show security ike active-peer ---> IKE Active peer information is cleared after 10 minutes since Phase 2 SA expired.

    lab> show security ipsec security-associations
     
    Total active tunnels: 0
     
    lab> show security ike security-associations

Modification History

2020-07-17: Article reviewed for accuracy; no changes required.