We're evaluating CloudGen firewalls for a branch rollout. The pilot unit is up, but the site-to-site VPN to our main data center is flaky. It's not random—it disconnects every 30 minutes on the dot. Then reconnects after a minute or two.
Support pointed to the default Phase 2 key lifetime. Sure, it's set to 1800 seconds. Changed it to 28800. Problem persisted. No joy on the rekeying margin either. Their KB articles are a decade old. Before I escalate and commit to this for 50 sites, has anyone actually fixed this? Or is this the "stable" operation the gushing reviews don't mention?
always check the last 6 months of reviews
Ah, the siren song of the "pilot unit." I feel this. It's the vendor's chance to show you a perfect world before you buy the fleet. You changed the Phase 2 lifetime and it still drops on the 30-minute cadence? That tells me it's not the Phase 2 rekey. That's the first thing everyone, including support, jumps to.
Look for a different timer that's on a 30-minute heartbeat. A dead peer detection, a connectivity check, maybe even a route advertisement interval from something upstream. The firewall might be deciding the path is dead because it's not seeing some other expected traffic. Your data center end might be silently tolerating it while your branch unit is the one throwing the fit and tearing it down.
The fact it reconnects cleanly points to a policy, not a fundamental incompatibility. I'd be digging in the logs on both ends for the five seconds before the drop, not after. Find what trigger event is being logged. "Stable operation" often means "stable in their lab, with their config." You're now in the real world.
Yeah, the Phase 2 lifetime is the classic answer. Since changing that didn't help, I'd be looking at a different timer too. Is there a keepalive or DPD (Dead Peer Detection) setting on a 30-minute cycle? That was the culprit on a different vendor's box I worked with once. It was sending a DPD request right on schedule and tearing down when it didn't get the expected reply format from the peer. Might be worth checking if you can just disable DPD on the branch side as a test.
Good call looking past the Phase 2 lifetime, that's the red herring they always chase. Been there migrating from a different platform to CloudGen last year.
Since it's on an exact 30-minute cycle, check the Phase 1 lifetime as well. It's often overlooked and defaults to 8 hours, but I've seen aggressive setups default to 1800 seconds too. If that's expiring and the rekey fails, it'd drop the whole tunnel. The Phase 2 change wouldn't matter.
Also, verify there isn't a mismatched "IKE Keep Alive" or "DPD Interval" between the two firewalls. If the data center side is sending DPD probes every 1800 seconds and the branch box ignores them or replies wrong, that's your disconnect. A packet capture on the WAN interface showing the spike of IKE traffic right before the drop would confirm it.
Backup twice, migrate once.