Asa5520 Isakmp Rekeying SA

Unanswered Question
May 18th, 2007
User Badges:

When the Isakmp Sa rekeying takes place, does the Asa drop all current connections? Do the connections get dropped when the Ipsec Sa lifetime expires? And, one more, is there a standard design philosoply regarding the Isakmp Sa lifetime and the Ipsec Sa lifetime? Hope not too may ?'s for one post. Thanks.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Anonymous (not verified) Thu, 05/24/2007 - 10:57
User Badges:

I don't think that during Isakmp sa rekeying the connections are dropped but during ipsec sa lifetime expiry I think that connections are dropped. Following links may help you

joel.kriske Fri, 05/25/2007 - 04:50
User Badges:

Thanks for the reply. I have both my isa and ipsec sa's set to timeout at 43200. I don't know whether using the same time is good or bad yet. Anyway, I have been telnet'd into these Asa's alot since I put them in and have seen several rekeys. I have not seen any disconnects at all during the rekeys. The rekeys don't wait until the time is up either. They usually happen somewhere around 5000-6000 seconds left. Thanks again.

ggilbert Fri, 05/25/2007 - 10:23
User Badges:
  • Cisco Employee,


The re-key should happen around 75% of the lifetime specified. So, if it is set to one hour, then at around 45 minutes...the re-key happens.

Also, during the re-key the connections should not be dropped.

deb cry isa 190

deb cry ipsec 190

Enable those debugs on the ASA, and you will be able to find out what is happening during this time.

I will be able to take a look at the debugs and let you know what is happening.



joel.kriske Tue, 05/29/2007 - 07:07
User Badges:

Gilbert, I figured out the issue. Exceed opens several tcp connects. Using a sniffer I was able to see where the Exceed idle tcp connects were getting dropped by the Asa and that would in turn take down the active tcp connect. I since extended the tcp idle timeout and the drops stopped. Working with TAC I received a Modular Policy Framework resolution to set tcp idle timeouts for individual tcp connects (vs the global timeout). Thanks for the assistance!

ggilbert Tue, 05/29/2007 - 07:37
User Badges:
  • Cisco Employee,


Glad to know!! :)

Sharing your MPF in this case would help out others as well. :) Just a thought!!



This Discussion