NSX IPsec VPN Disconnects During IKEv1 Rekey Phase 1 Teardown

Products

• VMware NSX

Issue/Introduction

VMware NSX IPsec VPN connections experience intermittent traffic loss during scheduled Phase 1 SA rekey operations when using the IKEv1 protocol. The NSX User Interface may continue to display tunnel status as "UP" while datapath traffic fails.

Log messages in /var/log/syslog on the NSX Edge node show Phase 1 SA teardown:

2026-07-13T12:27:17.368Z <REDACTED_HOSTNAME> NSX 12782 VPN [nsx@6876 comp="nsx-edge" subcomp="iked" s2comp="iked-event" level="INFO"] Request for IKE session status update for session: 8193, local_ip: <REDACTED_IP>, peer_ip: <REDACTED_IP> status: IKE_STATUS_UP, error:
2026-07-13T12:28:17.318Z <REDACTED_HOSTNAME> NSX 12782 VPN [nsx@6876 comp="nsx-edge" subcomp="iked" s2comp="iked-event" level="INFO"] Request for IKE session status update for session: 8193, local_ip: <REDACTED_IP>, peer_ip: <REDACTED_IP> status: IKE_STATUS_DOWN, error: IKE SA deleted

Keywords: NSX, Edge, IPsec, VPN, iked, IKEv1, IKE_STATUS_DOWN, IKE SA deleted, Phase 1, Phase 2, FortiGate, rekey, disconnect

Environment

• VMware NSX 4.2.3.3

Cause

When cleaning up an expiring IKEv1 Phase 1 SA after the 60-second grace period, NSX emits a control-plane teardown event (IKE SA deleted) that causes datapathd to flush or invalidate associated Phase 2 (IPsec) SAs.

Resolution

Primary Resolution: Migrate the IPsec VPN session configuration from IKEv1 to IKEv2. IKEv2 handles overlapping rekey transitions natively without invalidating Phase 2 datapath SAs.

Workaround 1 (Peer Auto-Negotiate): Enable auto-negotiate on the peer (e.g., FortiGate) Phase 2 selectors to trigger immediate Phase 2 SA renegotiation as soon as the datapath SAs are cleared.

Workaround 2 (Lifetime Alignment): Configure Phase 2 lifetimes (e.g., 28,800s / 8 hours) to be significantly shorter than Phase 1 lifetimes (e.g., 86,400s / 24 hours) to avoid simultaneous rekey collisions.