GlobalProtect Tunnel Rekey Failure: IKE and IPsec Lifetime Mismatch

Quick Answer

The correct answer is a rekey lifetime mismatch between the IKE gateway and the IPsec SA because IPsec's security depends on periodically refreshing keys before they expire, and that refresh process is coordinated across two separate negotiation layers with their own independent lifetimes. The IKE gateway establishes and periodically rekeys the phase 1 SA, which in turn protects the negotiation of the phase 2 IPsec SA used to actually encrypt user traffic. If the IKE phase 1 lifetime is configured shorter than the IPsec phase 2 lifetime, the underlying secure channel that phase 2 depends on can expire and need to be rebuilt before the data-plane SA it is supposed to be protecting has finished its own lifecycle, and the rekey attempt fails because the foundation it relies on disappeared out from under it. The practical result is exactly what was reported: sessions that periodically drop and reconnect, timed to whatever the shorter of the two lifetimes happens to be. Whenever a scenario describes a VPN or GlobalProtect tunnel that works initially but disconnects on a recurring cycle, especially with rekey-related log messages, think about whether the phase 1 and phase 2 lifetimes are properly aligned rather than assuming a routing or authentication failure.