Symptoms

Altering the definition of an ike-peer does not expire the connflow used for the tunnel, so it remains in use for the tunnel.

Impact

In effect, you cannot change the configuration of the flow by changing the peer definition.

Conditions

-- Making any change to an IKEv2 ike-peer, even insignificant changes such as a description change. -- Running a system version that has new attribute auth-rule inside ike-peer. Note: This is not likely to occur in older system versions where no ike-peer state exists inside a connflow, because any ike-peer changes do replace the associated objects. In those cases, even though the same connflow is used, the system uses new algorithms for the ike-peer.

Workaround

There is no workaround at this time.

Fix Information

Changes in ike-peer now expire any existing connflow for that ike-peer. This affects only a system version that has new attribute auth-rule inside ike-peer.

Behavior Change