Article / IPsec policy incorrect? (Configuring Site to Site VPN tunnels to Azure VPN Gateway)

[mmzzaq]

In this article: https://documentation.meraki.com/MX/Site-to-site_VPN/Configuring_Site_to_Site_VPN_tunnels_to_Azure_V...

you see Meraki choosing a IPsec policy preset called 'Azure'. This policy does a Phase 2 Lifetime of 3600.

In this article: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-devices

at 'IKE Phase 2 (Quick Mode) parameters' you see Azure doing a RouteBased Phase 2 Lifetime of 27000. IPsec policy's are not editable in Azure.

Either the Meraki article or the IPsec template which you select in the Meraki device is incorrect (Phase 2 Lifetime should be 27000 on Meraki's side instead of 3600).

Note: Azure does not support PolicyBased in combination with Meraki so PolicyBased settings are not applicable (see 'Validated VPN devices and device configuration guides' in the Azure article).

[KarstenI]

Although the lifetimes are different, there is typically no problem with this. In IKEv1 the Phase 1 and Phase 2 lifetimes  are negotiated to the lower of both values.

[mmzzaq]

Incorrect, the link to Azure will not work with a P2 lifetime of 3600.

[KarstenI]

Are you shure that the problem is based on the lifetime? I‘m pretty sure that I run default lifetimes (which are either 1h or 8h; although this is not on the MX) with Azure connections and they are negotiated correctly.

[mmzzaq]

Yes on my MX64 there was an error in the event log stating the P2 lifetime mismatch and the link wasn't working (unless the link wasn't working due to other reasons).