Remote direct access connectivity issue after IPsec SA rekey failure

Question

Remote direct access connectivity issue after IPsec SA rekey failure

Jiya Raha 100

Hi all

Imagine a situation where Remote DirectAccess clients are connected to internal corporate resources, but every 60 minutes the connection drops. Network traces reveal that IPsec main mode SA negotiation completes successfully, yet quick mode SA rekeying fails because NAT-Traversal keepalive packets time out. As a result, users are forced to reconnect repeatedly, which disrupts productivity and causes frustration. This issue becomes especially critical when remote employees rely on continuous access to sensitive internal applications for their daily work.

In such a case, I’ve heard that adjusting IPsec SA lifetime settings could help stabilize the connection. However, I’m not sure which specific PowerShell commands or Group Policy configurations should be applied, nor how to fine-tune these values to ensure reliable operation in a NAT-Traversal environment.

IPsec SA lifetime settings

NAT-Traversal timeout issue

DirectAccess connectivity problem

Any engineers provide detailed guidance on the best way to adjust these IPsec SA lifetime parameters to prevent recurring disconnections ?

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hello,

The disconnects you’re seeing are tied to the default quick mode SA lifetime of 3600 seconds. When rekeying occurs at the one‑hour mark, NAT devices often drop the UDP mapping, which causes the tunnel to fail even though main mode remains valid. The fix is to shorten the quick mode SA lifetime so renegotiation happens before the NAT binding expires. A stable value is 1800 seconds (30 minutes), and in more aggressive NAT environments 900 seconds (15 minutes) works better. You can apply this directly on the DirectAccess server with Set-NetIPsecQuickModeCryptoSet -Name "DirectAccess-QM" -MaxLifetimeSeconds 1800. Afterward, restart the IPsec Policy Agent service or reboot to enforce the change. If you prefer Group Policy, edit the DirectAccess IPsec policy under Computer Configuration > Windows Settings > Security Settings > IP Security Policies, and adjust the quick mode lifetime there, ensuring both server and clients receive the update. NAT‑T keepalives are sent every 20 seconds by default, which is usually sufficient, but lowering the quick mode lifetime is the supported and reliable way to prevent the recurring drops. This adjustment typically resolves the 60‑minute disconnect pattern and stabilizes DirectAccess connectivity.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

HP.