Why Your VPN Drops Every Time the Keys Rotate

The connection works for an hour and then dies, and the client reports nothing more useful than disconnected. That period is the clue, because something about the renewal exchange differs from the initial handshake. The timer only decides when you meet it. Save the messages from that exchange rather than the final label.

Read the Stage, Not the Label

In IKEv2 the IKE association and the CHILD association are renewed on separate schedules. A proposal that was acceptable for the first negotiation is not automatically acceptable for the second. One may complete while the other is rejected, which produces a tunnel that half exists. Capture the exchange with the tooling that owns it rather than a client log line:

swanctl --list-sas
swanctl --log --level 2
ip xfrm state list

For OpenVPN, the equivalent event is a renegotiation governed by the version and the deployment settings. Its authentication behaviour has its own failure modes. The message that matters names the failed stage, and you should record it verbatim instead of paraphrasing it into a ticket.

Write the timestamps down as well. A drop at a fixed interval after the last successful negotiation is a very different finding from one that arrives at random during use, and the interval is often the only evidence that survives.

Compare the Proposal That Fails

A rejected proposal produces a clear message on the responder. The usual cause is a difference between the two ends in algorithm, key length, group or lifetime. The initial child negotiation may have succeeded because it was initiated by the other side, which means it used the other side's proposal list. Look at both ends before changing anything.

Lifetime mismatches deserve special attention, because a value that looked generous on one end can make the other end initiate a renewal it cannot complete. The rekeying behaviour documentation describes how association renewal is triggered and how the two ends can differ in their timing expectations. Compare what each end claims to support rather than what the configuration file suggests.

An old profile or a provider template can pin a proposal that the current release no longer offers. The mismatch only surfaces when a fresh negotiation is forced.

Separate a Credential Problem From an Unreachable Peer

A renewal that fails authentication looks similar in the client and completely different on the server. If a credential is re-checked at renegotiation, an expired certificate, a revoked account or a changed password will produce a drop at exactly the renewal interval while every earlier connection succeeded. An unreachable peer is the third possibility, and it produces no rejection at all: the packets leave and nothing answers. That case usually tracks a network change rather than a timer, so check whether the failure follows a roam, an idle period or a route change.

Distinguish the three by what the far end logged. A rejection with a reason, an authentication failure and silence are three different corrections. Restarting the client collapses them into one unhelpful observation.

Check the certificate dates and the account state before blaming the network. Both are cheap to inspect and both are invisible in the client's own message.

Force One Renewal and Read the Result

Force one renewal through the operator's supported method rather than waiting an hour for the next one. Keep the required failure policy intact while you do it. Disabling verification or stretching lifetimes to a day makes the symptom disappear from your logs without correcting anything. It also leaves a longer outage waiting for the next person.

Once a fix is in place, check the renewed tunnel and then make a new request from the application. An application session that was alive when the association changed may need its own recovery even though the tunnel is healthy again. Users will report that as the VPN still being broken.

Record the release versions, the negotiated timers and the stage that failed. The next recurrence can then be compared with this one instead of being described again from memory.