Mobile IKEv2 Child SA Rekeying Issue on Windows 7
-
We have a mobile IKEv2 Windows 7 client that is dropping the connection roughly every 45min-75min. I saw it exactly when the rekey timer on pfsense expired.
This is apparently because Windows 7 does not support rekeying initiated by the gateway, though it does rekey every 58 minutes and 46 seconds.:
https://wiki.strongswan.org/projects/strongswan/wiki/Windows7#CHILD_SA-rekeyingStrongSwan by default has a 9 minute rekeying margin with a random fuzz factor that can double it for when it decides to rekey. In result, StrongSwan may try to rekey within 42 minutes if the lifetime is an hour. Thus breaking the connection.:
https://wiki.strongswan.org/projects/strongswan/wiki/Windows7#CHILD_SA-rekeyingIt seems that I can check "Disable rekey" in the phase 1 settings. I'm just wondering if there will be any ill effects as a result especially with other operating systems (iOS, macOS, Win 8.1, Win 10).
The safer alternative may be to simply raise the child SA lifetime to 2 hours. Going to try that for now.
-
Seems that upping the lifetime to two hours simply made it drop less often. I set it back to one hour and disabled rekeying as a test.