Question

An engineer builds a route-based IPsec VTI tunnel between an on-premises Cisco IOS XE router and an AWS cloud-hosted Cisco IOS XE router across the internet. The tunnel establishes successfully and passes traffic, but every few hours users report a brief drop of about 20-30 seconds, after which connectivity restores by itself. Debugs on the on-premises router show IKEv2 CHILD_SA re-creation events coinciding with the outages, and the two routers are configured with different IPsec SA lifetimes (on-prem 3600 seconds, AWS side 28800 seconds). What is the MOST likely cause of the periodic outage, and what corrective action addresses it?

Accepted Answer

The mismatched IPsec SA lifetimes cause the peer with the shorter lifetime to trigger a rekey that the other peer processes slowly; align the IPsec (CHILD_SA) lifetimes and ensure the IKEv2 profiles allow smooth rekeying to eliminate the reconvergence gap.

Answer

The IKEv2 proposal encryption transforms do not match, forcing full tunnel renegotiation; reconfigure both routers to use identical encryption and integrity algorithms.

Answer

BGP hold timers are expiring on the tunnel; increase the BGP keepalive and hold-time values on both routers to prevent the neighbor from resetting.

Answer

The tunnel MTU is too large, causing periodic fragmentation drops; lower the tunnel interface MTU and apply a TCP MSS clamp to stop the outages.