Virtual Hub - VPN Gateway - IKE Lifetime

Question

Hello,

In a custom IPsec configuration there is only one lifetime setting defined as:

'SA Lifetime in seconds' - I understand this is the Phase 2 lifetime from the description.

What is then the lifetime for the IKE Phase 1 tunnel ?

How can I check these parameters via logs ?

I have check logs from https://learn.microsoft.com/en-us/azure/vpn-gateway/troubleshoot-vpn-with-azure-diagnostics and there are no details there.

Best Regards,

Diogo

Answer 1

Hi @Caldeira Coutinho Diogo

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

• Azure VPN gateways have a fixed, non-configurable IKE Phase 1 lifetime. This value is typically 28,800 seconds (8 hours). For your reference: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-vpn-faq#:~:text=IKE%20Main%20Mode%20SA%20lifetime%20is%20fixed%20at%2028%2C800%20seconds%20on%20the%20Azure%20VPN%20gateways.
• Unlike the Phase 2 SA lifetime, you cannot modify the IKE Phase 1 SA lifetime in Azure using the portal, CLI, or PowerShell. This is a deliberate design choice to maintain interoperability and stability.
• Phase 1 is primarily for establishing a secure channel for subsequent Phase 2 negotiations. It's designed for longer durations and less frequent renegotiation.
• Phase 2 is where the actual data encryption parameters are negotiated. These SAs are typically more dynamic and have shorter lifetimes.
• The standard Azure diagnostic logs you linked might not expose these specific IKE SA lifetimes directly, especially for Phase 1.
• You can use a packet capture on your on-premises VPN gateway and use a tool like Wireshark to filter and analyze the IKEv1 traffic, within the IKEv1 packets, examine the SA payloads.
• You should be able to see the proposed and accepted lifetime values and it requires access to capture traffic on the on-premises device.
• Otherwise NSG Flow Logs version 2 provide more detailed information about network traffic flowing through Network Security Groups.
• While they might not explicitly show the IKE SA lifetime, they could indirectly help you infer when a new Phase 1 negotiation occurs based on the traffic patterns and flow timestamps.

Kindly let us know if the above helps or you need further assistance on this issue.

Thanks,

Sai.