This is normal behavior.  Usually the tunnel will re-establish sooner than the seconds expiry.  I believe there also is a data limit but the MX will rekey sooner than the configured and this should be relative to the amount of seconds configured. So your logs will show initial IKE_SA where the CHILD_SA is instantiated in the same message which means you will probably get a log for the initial CHILD_SA.  And then after a while you will get the established for the new CHILD_SA and a closing of the old CHILD_SA.  You will also see the sequence numbering <remote-peer|90177> count up in the newer SA.  The log does show separate entries for inbound and outbound CHILD_SA. ... View more