This article describes about the log messages " KMD_PM_SA_ESTABLISHED" due to Mode: Tunnel, Type: dynamic ,SA op: Rekeyed
You will see below log messages for ipsec vpn's which are established already
++++++++++++++RSI++++++++++++
root@Router_A> show services ipsec-vpn ike security-associations
Remote Address State Initiator cookie Responder cookie Exchange type
52.77.79.236 Matured e30abd834870ad53 8f90307e1cf32aad IKEv2
18.140.94.238 Matured affa812bc318cea1 c210a70e6eea1248 IKEv2
52.76.66.137 Matured c6b51cd48eb01f27 62575d851baf17f5 IKEv2
52.76.146.235 Matured f460ae81d943eec4 32f40cd9e344d0a9 IKEv2
18.142.232.37 Matured b20eec3ad9c3ed4f ed02b5cb9d798bb1 IKEv2
52.221.28.212 Matured d05ffed35566bf06 6bc8a839e5247acc IKEv2
52.74.73.249 Matured 0739e14088b67a2b 356099136f79e09d IKEv2
13.228.12.164 Matured 84be0498a38c1285 792a6398a718e830 IKEv2
++++++++++++++++log-messages++++++++++++
Jul 12 07:30:00 Router_A newsyslog[11661]: logfile turned over due to size>1024K
Jul 12 07:38:00 BS7-CORE-RTR1 kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel4.IPSEC-MSS-RULE-Tunnel4.1__, Local gateway: 69.210.73.113, Remote gateway: 52.77.79.236, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0x23ddeaae, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed
Jul 12 07:38:00 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel4.IPSEC-MSS-RULE-Tunnel4.1__, Local gateway: 69.210.73.113, Remote gateway: 52.77.79.236, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0xcf897b7a, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed
Jul 12 07:38:59 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel5.IPSEC-MSS-RULE-Tunnel5.1__, Local gateway: 69.210.122.3, Remote gateway: 13.228.12.164, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0x277f3b72, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed
Jul 12 07:38:59 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel5.IPSEC-MSS-RULE-Tunnel5.1__, Local gateway: 69.210.122.3, Remote gateway: 13.228.12.164, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0xcb79d24c, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed
Aug 22 21:23:47 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel8.IPSEC-MSS-RULE-Tunnel8.1__, Local gateway: 69.210.122.1, Remote gateway: 52.221.28.212, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0xee846bb5, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed
Aug 22 21:23:47 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel8.IPSEC-MSS-RULE-Tunnel8.1__, Local gateway: 69.210.122.1, Remote gateway: 52.221.28.212, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0xcf83c05d, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed
Aug 22 21:25:15 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel5.IPSEC-MSS-RULE-Tunnel5.1__, Local gateway: 69.210.122.3, Remote gateway: 13.228.12.164, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0xe0f26335, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed
Aug 22 21:25:15 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel5.IPSEC-MSS-RULE-Tunnel5.1__, Local gateway: 69.210.122.3, Remote gateway: 13.228.12.164, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0xc4fcfab4, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed
Aug 22 21:37:16 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel6.IPSEC-MSS-RULE-Tunnel6.1__, Local gateway: 69.210.122.3, Remote gateway: 52.74.73.249, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0x29664111, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed
Aug 22 21:37:16 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel6.IPSEC-MSS-RULE-Tunnel6.1__, Local gateway: 69.210.122.3, Remote gateway: 52.74.73.249, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0xc2e96397, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed
Aug 22 21:37:17 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel7.IPSEC-MSS-RULE-Tunnel7.1__, Local gateway: 69.210.122.1, Remote gateway: 18.142.232.37, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0x17378146, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed
Aug 22 21:37:17 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel7.IPSEC-MSS-RULE-Tunnel7.1__, Local gateway: 69.210.122.1, Remote gateway: 18.142.232.37, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0xcd94ca29, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed
Aug 22 21:37:17 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel1.IPSEC-MSS-RULE-Tunnel1.1__, Local gateway: 69.210.121.91, Remote gateway: 52.76.66.137, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0xb010ac5d, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed
Aug 22 21:37:17 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel1.IPSEC-MSS-RULE-Tunnel1.1__, Local gateway: 69.210.121.91, Remote gateway: 52.76.66.137, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0xce16e83e, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed
Aug 22 21:40:35 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel4.IPSEC-MSS-RULE-Tunnel4.1__, Local gateway: 69.210.73.113, Remote gateway: 52.77.79.236, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0x19dce818, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed
Aug 22 21:40:35 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel4.IPSEC-MSS-RULE-Tunnel4.1__, Local gateway: 69.210.73.113, Remote gateway: 52.77.79.236, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0xc8985381, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed
Aug 22 22:03:48 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel8.IPSEC-MSS-RULE-Tunnel8.1__, Local gateway: 69.210.122.1, Remote gateway: 52.221.28.212, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0x5cde909a, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed
Aug 22 22:03:48 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel8.IPSEC-MSS-RULE-Tunnel8.1__, Local gateway: 69.210.122.1, Remote gateway: 52.221.28.212, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0xcea327b3, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed
Aug 22 22:05:15 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel5.IPSEC-MSS-RULE-Tunnel5.1__, Local gateway: 69.210.122.3, Remote gateway: 13.228.12.164, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0x1299a4a8, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed
Aug 22 22:05:15 Router_A kmd[5344]: KMD_PM_SA_ESTABLISHED: Tunnel cfg name: __IPsec_ss_ms_Tunnel5.IPSEC-MSS-RULE-Tunnel5.1__, Local gateway: 69.210.122.3, Remote gateway: 13.228.12.164, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0xc9ab6c3b, AUX-SPI: 0, Mode: Tunnel, Type: dynamic ,SA op: Rekeyed
Yes Rekeying should not interrupt traffic. There are two timers for every IPSEC SA pair. Soft and hard. Hard timer is the lifetime-seconds parameter you configure under ipsec proposal. By default 3600s. Soft timer is more or less 5/6 of the hard timer. When the soft timer expires rekeying process starts and new pair of SAs is negotiated.
This is not the complete IPSEC-tunnel that is re-establishing but rekeying SA negotiations only which will ideally not impact any services.