Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are having a IPsec/GRE VPN tunnel issue at work. Our vendor told me he "forced a rekey" and everything started working again. He alluded to a command to this, but didn't tell me the exact one. Does anyone know how to force a IPSec VPN to rekey?

share|improve this question
up vote 2 down vote accepted

I can't recall ever seeing anything to force a rekey; he may have just cleared the security association and let it build a new one. clear crypto sa peer x.x.x.x will keep the phase 1 and rebuild phase 2, clear crypto isakmp id with the id from show crypto isakmp sa will reset the whole tunnel.

share|improve this answer

Just checked on one of mine. You have these options:

 R1#clear crypto ?
  call     Clear crypto call admission info
  ipsec    IPSec
  isakmp   Flush the ISAKMP database
  mtree    Clear Mtree Manager Command Stats
  sa       Clear all crypto SAs
  session  clear crypto sessions (tunnels)

R1#clear crypto isa
R1#clear crypto isakmp ?
  <0-32766>  connection id of SA

R1#clear crypto sa ?
  counters  Reset the SA counters
  map       Clear all SAs for a given crypto map
  peer      Clear all SAs for a given crypto peer
  spi       Clear SA by SPI
  vrf       VRF (Routing/Forwarding) instance

R1#clear crypto sa peer
R1#clear crypto sa peer ?
  A.B.C.D  Crypto peer name/address
  vrf      VRF (Routing/Forwarding) instance

R1#clear crypto sa peer

clear crypto sa peer will do the trick

share|improve this answer
That looks like it. Thanks for the help. – Jeshii Sep 19 '11 at 16:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.