Network & Infrastructure / Segmentation, TLS & Secure Connectivity
IPsec rekey overlap and periodic application interruption
A VPN drops traffic at regular intervals while its tunnel dashboard quickly returns to green. Rekey negotiation or old/new association overlap may be mishandled at those intervals.
Environment and inputs: Stateful network boundaries, TLS endpoints and IPsec gateways; use the deployed security policy and implementation manual. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Correlate IKE and child-SA lifetimes, rekey events, packet counters and peer logs. Record which direction loses encrypted or decrypted traffic and whether both peers initiate simultaneously.
Explain the result
Rekeying should replace security state without exposing an unprotected gap, but interoperability, lifetimes and policy can affect the transition. A new SA existing does not prove both peers selected it consistently.
Plan the fix
Align supported proposals, lifetime behavior and rekey handling using both vendors' documentation. Preserve cryptographic policy rather than switching to a weak suite to make negotiation appear simpler.
Check the result and rollback
Observe several rekey cycles under representative traffic and test peer restart separately. Revert if periodic loss persists or old associations remain usable beyond their intended lifecycle.