- Newest
- Most votes
- Most comments
When dealing with site-to-site VPN tunnels that keep going up and down, it is often due to configuration settings related to the negotiation of security associations and the detection of peer availability. Based on the settings you provided and common best practices, here are some adjustments you can make to improve the stability of your VPN tunnels:
1.Increase Phase 1 and Phase 2 Lifetime:
Phase 1 Lifetime (IKE): Currently set to 28,800 seconds (8 hours). Increase this to a longer duration such as 86,400 seconds (24 hours) to reduce the frequency of IKE rekeying.
Phase 2 Lifetime (IPsec): Currently set to 3,600 seconds (1 hour). Increase this to a longer duration such as 14,400 seconds (4 hours) to reduce the frequency of IPsec rekeying.
Adjust Rekey Margin Time:
Rekey Margin Time: Currently set to 270 seconds (4.5 minutes). Increase this to a longer duration such as 900 seconds (15 minutes). This gives more time for rekeying negotiations to complete before the current security association expires. Adjust Dead Peer Detection (DPD) Settings:
DPD Timeout: Currently set to 30 seconds. Increase this to a longer duration, such as 60 seconds or 120 seconds. This allows more time for detecting inactive peers before taking action.
DPD Action: The "clear" action is used to clear IKE and IPsec Security Associations (SAs) if a peer is unreachable. Ensure that this action is suitable for your network requirements. If "clear" is causing frequent tunnel resets, you might consider using "restart" or "hold" depending on your network's behavior and needs.
Recommended Settings
Phase 1 Lifetime: 86,400 seconds (24 hours) Phase 2 Lifetime: 14,400 seconds (4 hours) Rekey Margin Time: 900 seconds (15 minutes) DPD Timeout: 60-120 seconds DPD Action: clear (or consider "restart" or "hold" if "clear" is problematic) Hope this is helpful
Relevant content
- asked 2 years ago
- asked 2 months ago
Thanks for the answer. After I increased the DPD interval from 10 seconds to 30 seconds on the office router, the connections are more stable now. But I didn't change the settings on the AWS side.
Dear Kranthi Putti and Oleksii Bebych, please could you instruct me how could I set the Phase 1 Lifetime to 86,400 seconds if the max allowed Lifetime is 28,800 in my AWS VPN set up? Thank you very much!
The maximum value for Phase 1 Lifetime (IKE) is 28,800 and for Phase 2 Lifetime (IPsec) is 3,600 regarding AWS documentation https://docs.aws.amazon.com/vpn/latest/s2svpn/VPNTunnels.html. So, how can I configure 86,400 for Phase 1 Lifetime (IKE)?