IKEv2 to an Azure VPN gateway is up and the transform sets match. The IPsec SA passes traffic and then drops when the router hits its shorter lifetime. Azure's lifetime is longer. What should change?
Select an answer to reveal the explanation.
Short Explanation
You hung up in the middle of a call Azure was still willing to keep. You set the router lifetime to the lifetime Azure is using, because the transform already matches and the SA dies on your shorter timer. The anti-replay window is not that timer.
Full Explanation
Both ends of an IPsec SA need a lifetime they can rekey on. This router uses a shorter lifetime than the Azure connection, so the SA drops when the router expires it even though the transform matches and IKE is up. Align the router with Azure's lifetime. The BGP hold timer is not copied into the IPsec lifetime. The OSPF dead interval is unrelated, and the Azure gateway is not running OSPF. The anti-replay window decides how much reordering is tolerated. It does not set how long the SA lives. Exam caveat: match the lifetime on every tunnel to that gateway. A second tunnel left on the old timer will drop on its own schedule. Operational check: after the lifetimes match, the SA should rekey without a traffic gap, and show crypto ipsec sa should stay up through the old expiry point.