> Source: [sk118536](https://support.checkpoint.com/results/sk/sk118536)

# sk118536 - StrongSwan VPN disconnection when idle

| Property | Value |
|----------|-------|
| Solution ID | sk118536 |
| Date Created | 2017-07-10 |
| Last Modified | 2026-02-23 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * VPN Site To Site with StrongSwan (mobile router using Linux with IPSec implementation) fails.
* Unstable VPN connection between the VPN peers.
* Security Gateway not able to create new keys with StrongSwan.
* Client to Site with StrongSwan fails when idle.   
  The StrongSwan sent DPD in fixed intervals.
* On the ikev2.xmll we see that the StrongSwan sent DPD, and we reply for the first few times, and then we sent "Info" packet with "Invalid SPI".
* On the vpnd.elg we see:   
  \[iked 39901 4078163968\]@hostname\[29 Jun 8:35:37\]\[VPNIO\] vpn_trap_multik: received IKEV2_ESP_SA_EXPIRED   
  \[iked 39901 4078163968\]@hostname\[29 Jun 8:35:37\] GetEntryIsakmpObjectsHash: received ipaddr:x.x.x.x as key, found fwobj: NULL   
  \[iked 39901 4078163968\]@hostname\[29 Jun 8:35:37\] fwipsechost_from_ipxaddr: calling GetEntryXIsakmpObjectsHash for x.x.x.x returned obj: (nil)   
  \[iked 39901 4078163968\]@hostname\[29 Jun 8:35:37\]\[ikev2\] esp_sa_expired_trap: Deleting ESP SA for: inbound 8f73b6b1, outbound c30375ff, peer=x.x.x.x, cookies=6ed6cab91c21248d:0e7770d7851d6ff1, instance: 17   
  \[iked 39901 4078163968\]@hostname\[29 Jun 8:35:37\]\[io\] \[IOCTL\]: "VPN_GET_COOKIES_BY_PEER" \| INSTANCE: 0 \| RUNTIME: 0.000036sec \| FUNCTION: getSPIsByPeer \| API: _vpnd_ioctl.   
  \[iked 39901 4078163968\]@hostname\[29 Jun 8:35:37\]\[ikev2\] ikeExchangeFlowHandler::DeleteIPSecSAs: IKE SA is no longer valid   
  \[iked 39901 4078163968\]@hostname\[29 Jun 8:35:37\]\[io\] \[TRAP\]: IKEV2_ESP_SA_EXPIRED took 0.000114 seconds. \[iked 39901 4078163968\]@hostname\[29 Jun 8:35:37\] kmsg_read_local: 1 kmsgs handled

## Cause

There is a known issue with Strongswan that it only stores (and uses) keys that are re-keys of existing keys.

There are even scenarios when Strongswan peer itself starts a new Phase 2 exchange but never stores the exchanged keys because they are not re-keys of existing key and then we are not able to decrypt the traffic encrypted with the new keys.

## Solution

This problem was fixed. The fix is included in:

* [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 75
* [Jumbo Hotfix Accumulator for R81](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81/R81.00/R81.00-List-of-all-Resolved-Issues.htm) starting from Take 72
* [Jumbo Hotfix Accumulator for R80.40](https://sc1.checkpoint.com/documents/Jumbo_HFA/R80.40/Default.htm) starting from Take 172

If you choose not to upgrade, follow these steps.  

Note, that the below solution is a ***workaround*** and only works when both sides are using IKEV2, tunnel will still fail if you are using IKEV1.  

Enable the following VPN kernel flag on the Security Gateway by running the command:

`# fw ctl set int strongswan_bug_workaround 1`

Note: this command does not survive a reboot.

In case it resolves the issue, follow the instructions in [sk26202](https://support.checkpoint.com/results/sk/sk26202) to set the `strongswan_bug_workaround` parameter to survive reboot.

With the flag on, the Security Gateway only store new keys if they are re-keys of existing ones (or if there are no existing ones).

Note that this flag is relevant to IKEv2 only.  

<br />

This workaround may not work with Client to Site VPN.  

To make this change permanent, please contact Check Point Support to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect CPinfo files from the Security Management and Security Gateways involved in the case.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content