Description

This article describes about the log messages " KMD_PM_SA_ESTABLISHED" due to Mode: Tunnel, Type: dynamic ,SA op: Rekeyed

Symptoms

You will see below log messages for ipsec vpn's which are established already

 

++++++++++++++RSI++++++++++++

root@Router_A> show services ipsec-vpn ike security-associations

 

Remote Address State     Initiator cookie Responder cookie Exchange type

52.77.79.236  Matured    e30abd834870ad53 8f90307e1cf32aad IKEv2

18.140.94.238  Matured    affa812bc318cea1 c210a70e6eea1248 IKEv2

52.76.66.137  Matured    c6b51cd48eb01f27 62575d851baf17f5 IKEv2

52.76.146.235  Matured    f460ae81d943eec4 32f40cd9e344d0a9 IKEv2

18.142.232.37  Matured    b20eec3ad9c3ed4f ed02b5cb9d798bb1 IKEv2

52.221.28.212  Matured    d05ffed35566bf06 6bc8a839e5247acc IKEv2

52.74.73.249  Matured    0739e14088b67a2b 356099136f79e09d IKEv2

13.228.12.164  Matured    84be0498a38c1285 792a6398a718e830 IKEv2

 

++++++++++++++++log-messages++++++++++++

Jul 12 07:30:00 Router_A newsyslog[11661]: logfile turned over due to size>1024K

Jul 12 07:38:00 BS7-CORE-RTR1 kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel4.IPSEC-MSS-RULE-Tunnel4.1__, Local gateway: 69.210.73.113, Remote gateway: 52.77.79.236, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0x23ddeaae, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed

Jul 12 07:38:00 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel4.IPSEC-MSS-RULE-Tunnel4.1__, Local gateway: 69.210.73.113, Remote gateway: 52.77.79.236, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0xcf897b7a, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed

Jul 12 07:38:59 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel5.IPSEC-MSS-RULE-Tunnel5.1__, Local gateway: 69.210.122.3, Remote gateway: 13.228.12.164, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0x277f3b72, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed

Jul 12 07:38:59 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel5.IPSEC-MSS-RULE-Tunnel5.1__, Local gateway: 69.210.122.3, Remote gateway: 13.228.12.164, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0xcb79d24c, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed

Aug 22 21:23:47 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel8.IPSEC-MSS-RULE-Tunnel8.1__, Local gateway: 69.210.122.1, Remote gateway: 52.221.28.212, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0xee846bb5, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed

Aug 22 21:23:47 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel8.IPSEC-MSS-RULE-Tunnel8.1__, Local gateway: 69.210.122.1, Remote gateway: 52.221.28.212, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0xcf83c05d, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed

Aug 22 21:25:15 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel5.IPSEC-MSS-RULE-Tunnel5.1__, Local gateway: 69.210.122.3, Remote gateway: 13.228.12.164, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0xe0f26335, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed

Aug 22 21:25:15 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel5.IPSEC-MSS-RULE-Tunnel5.1__, Local gateway: 69.210.122.3, Remote gateway: 13.228.12.164, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0xc4fcfab4, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed

Aug 22 21:37:16 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel6.IPSEC-MSS-RULE-Tunnel6.1__, Local gateway: 69.210.122.3, Remote gateway: 52.74.73.249, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0x29664111, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed

Aug 22 21:37:16 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel6.IPSEC-MSS-RULE-Tunnel6.1__, Local gateway: 69.210.122.3, Remote gateway: 52.74.73.249, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0xc2e96397, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed

Aug 22 21:37:17 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel7.IPSEC-MSS-RULE-Tunnel7.1__, Local gateway: 69.210.122.1, Remote gateway: 18.142.232.37, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0x17378146, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed

Aug 22 21:37:17 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel7.IPSEC-MSS-RULE-Tunnel7.1__, Local gateway: 69.210.122.1, Remote gateway: 18.142.232.37, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0xcd94ca29, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed

Aug 22 21:37:17 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel1.IPSEC-MSS-RULE-Tunnel1.1__, Local gateway: 69.210.121.91, Remote gateway: 52.76.66.137, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0xb010ac5d, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed

Aug 22 21:37:17 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel1.IPSEC-MSS-RULE-Tunnel1.1__, Local gateway: 69.210.121.91, Remote gateway: 52.76.66.137, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0xce16e83e, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed

Aug 22 21:40:35 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel4.IPSEC-MSS-RULE-Tunnel4.1__, Local gateway: 69.210.73.113, Remote gateway: 52.77.79.236, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0x19dce818, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed

Aug 22 21:40:35 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel4.IPSEC-MSS-RULE-Tunnel4.1__, Local gateway: 69.210.73.113, Remote gateway: 52.77.79.236, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0xc8985381, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed

Aug 22 22:03:48 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel8.IPSEC-MSS-RULE-Tunnel8.1__, Local gateway: 69.210.122.1, Remote gateway: 52.221.28.212, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0x5cde909a, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed

Aug 22 22:03:48 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel8.IPSEC-MSS-RULE-Tunnel8.1__, Local gateway: 69.210.122.1, Remote gateway: 52.221.28.212, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0xcea327b3, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed

Aug 22 22:05:15 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel5.IPSEC-MSS-RULE-Tunnel5.1__, Local gateway: 69.210.122.3, Remote gateway: 13.228.12.164, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0x1299a4a8, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed

Aug 22 22:05:15 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel5.IPSEC-MSS-RULE-Tunnel5.1__, Local gateway: 69.210.122.3, Remote gateway: 13.228.12.164, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0xc9ab6c3b, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed

Solution

Yes Rekeying should not interrupt traffic. There are two timers for every IPSEC SA pair. Soft and hard. Hard timer is the lifetime-seconds parameter you configure under ipsec proposal. By default 3600s. Soft timer is more or less 5/6 of the hard timer. When the soft timer expires rekeying process starts and new pair of SAs is negotiated.

 

This is not the complete IPSEC-tunnel that is re-establishing but rekeying SA negotiations only which will ideally not impact any services.

 

Modification History

2024-09-15 : Article Created