“If an IPSec Site-to-Site VPN drops every 3,600 seconds, the issue is not network congestion—it is a Phase 2 lifetime or Perfect Forward Secrecy (PFS) renegotiation mismatch.”

While managing network security operations for financial clients at Wipro, a critical site-to-site IPSec VPN tunnel connecting a Checkpoint R77.30 gateway to a remote Cisco ASA firewall dropped for 30 seconds every hour on the dot.

Root Cause: IKE Phase 2 Lifetime & SPI Mismatches

Debug logs parsed in Checkpoint vpn debug ikeon revealed that Checkpoint initiated Phase 2 re-keying after 3,600 seconds (1 hour), while the Cisco ASA was configured for a 28,800-second (8-hour) Phase 2 lifetime with Perfect Forward Secrecy (PFS Group 5).

When Checkpoint generated a new Security Parameter Index (SPI), the Cisco ASA rejected the new Phase 2 SA because of mismatched PFS proposals, causing the tunnel to tear down and re-establish from scratch.

[!IMPORTANT] Always align both IKE Phase 1 (ISAKMP) and Phase 2 (IPSec) lifetimes, encryption algorithms (AES-256), hashing (SHA-256), and PFS Groups across multi-vendor VPN endpoints.

# # Checkpoint CLI Expert Mode Command to Debug IPSec IKE Key Exchange
vpn debug ikeon
tail -f $FWDIR/log/ike.elg | grep "SPI mismatch"

The Verdict

Key Takeaway

Align IKE Phase 1 and Phase 2 Rekey Parameters Exactly Across VPN Gateways.

Ensuring matching IPSec Phase 2 lifetimes and PFS Group configurations eliminates periodic tunnel teardowns and guarantees continuous site-to-site connectivity.