We are trying to establish a persistent VPN connection against a Juniper box. However there is some misconfiguration. When we start the StrongSwan service, the tunnel is up and all traffic go fine. But as soon as there is no traffic flow in a couple of seconds the connection is down and the service must be restarted. When we run an endless ping loop to the VPN destination IP address on background, the connection survive. We believe, it is some kind of keep-alive related problem. Does anyone see any possible configuration inconsistency?Spec sheet - both sites agreed upon the following IPSec settings:Phase 1 (Key Exchange):Encryption {3DES, AES256}: AES256Data Integrity {MD5,SHA1,SHA2}: SHA256Diffie-Hellman {MD5,SHA1,SHA2}: 5Renegotiate IKE SA {Seconds}: 86400  Phase 2 (Data Transport):IPSec: ESPEncryption {3DES, AES256}: AES256Data Integrity {MD5,SHA1,SHA2}: SHA256PFS: YesDiffie-Hellman: 5SA Life Time {Seconds}: 3600IP Compression: No  Related configuration files follows.ipsec.conf:config setup  charondebug=ike 4, knl 4, cfg 4, net 4, esp 4, dmn 4,  mgr 4conn %default  type=tunnel  authby=secret  ikelifetime=86400  lifetime=3600  keyexchange=ikev1  compress=no  dpdaction=restart  dpddelay=10s  dpdtimeout=500sconn otto-105-183  also=otto  rightsubnet=10.108.105.183/32conn otto-100-34  also=otto  rightsubnet=10.108.100.34/32conn otto-100-35  also=otto  rightsubnet=10.108.100.35/32conn otto  auto=start  ike=aes256-sha2_256-modp1536!  esp=aes256-sha2_256-modp1536!  left=%defaultroute  leftsubnet=10.107.54.33/32  leftfirewall=yes  right=my_public_IP_address  ; redactedcharon.conf:charon {    keep_alive = 20s    crypto_test {    }    host_resolver {    }    leak_detective {    }    processor {        priority_threads {        }    }    start-scripts {    }    stop-scripts {    }    tls {    }    x509 {    }}
StrongSwan 5.2.1 on Debian Jessie vs Juniper SSG 550M - Short connection life time
debian;ipsec;strongswan