IPSec becomes unstable after some days
-
Sorry, not much to go on yet, but after about 10 days my tunnel to an ASA is becoming unstable. SSH sessions are interrupted constantly as the phase 2 connection is dropping and rebuilding every couple of minutes.
The only other person I could find having this issue was here: https://www.mail-archive.com/users@lists.strongswan.org/msg10106.html
I only get about twenty minutes on the log and didn't have a chance to save it, but I was seeing the same retransmit failures as mentioned in that thread.
From the Cisco side it just looks like the pfSense drops and rebuilds the phase 2 normally. No errors. Any reports of anything similar?
-
As you said, not much to go on…
Check the IPSEC Phase 2 lifetime. They must match on both ends.
Beware that not all vendors describe the lifetime in the same units (seconds, minutes or hours), so be sure that you are comparing apples to apples.
The phase2 lifetime can also be specified in amount of data transferred. Again, they must match, but don't use time and amount lifetimes at the same time, that gets confusing.
