How to force a Cisco 2811 to rekey

Question

We are having a IPsec/GRE VPN tunnel issue at work. Our vendor told me he "forced a rekey" and everything started working again. He alluded to a command to this, but didn't tell me the exact one. Does anyone know how to force a IPSec VPN to rekey?

Answer 1

I can't recall ever seeing anything to force a rekey; he may have just cleared the security association and let it build a new one. clear crypto sa peer x.x.x.x will keep the phase 1 and rebuild phase 2, clear crypto isakmp id with the id from show crypto isakmp sa will reset the whole tunnel.

Answer 2

Just checked on one of mine. You have these options:

 R1#clear crypto ?
  call     Clear crypto call admission info
  ipsec    IPSec
  isakmp   Flush the ISAKMP database
  mtree    Clear Mtree Manager Command Stats
  sa       Clear all crypto SAs
  session  clear crypto sessions (tunnels)

R1#clear crypto isa
R1#clear crypto isakmp ?
  <0-32766>  connection id of SA
  <cr>

R1#clear crypto sa ?
  counters  Reset the SA counters
  map       Clear all SAs for a given crypto map
  peer      Clear all SAs for a given crypto peer
  spi       Clear SA by SPI
  vrf       VRF (Routing/Forwarding) instance
  <cr>

R1#clear crypto sa peer
R1#clear crypto sa peer ?
  A.B.C.D  Crypto peer name/address
  vrf      VRF (Routing/Forwarding) instance

R1#clear crypto sa peer

clear crypto sa peer will do the trick