IPsec tunnel won’t stay up

I have a static IPsec tunnel configured between a Debian cloud server running StrongSwan and a Juniper SRX 210. The tunnel goes up just fine, but it never stays up for long, the longest may be about 1hr. I think it’s because there isn’t much data traversing the tunnel and it times out.

StrongSwan config:

# ipsec.conf - strongSwan IPsec configuration file

config setup

# Add connections here.
conn vpn.mydomain.com
    auto=start
    keyexchange=ikev2
    authby=secret
    ike=aes128-sha256-modp2048s256
    ikelifetime=3h
    esp=aes128-sha256
    left=AAA.BBB.CCC.DDD
    leftid=@reverser.mydomain.com
    leftsubnet=192.168.2.0/24
    leftsourceip=192.168.2.2
    right=vpn.mydomain.com
    rightid=@vpn.mydomain.com
    rightsubnet=192.168.1.0/24
    dpdaction=hold
    dpddelay=60
    dpdtimeout=500

SRX Config (partial):

proposal ike-vpn-proposal {
    authentication-method pre-shared-keys;
    dh-group group24;
    authentication-algorithm sha-256;
    encryption-algorithm aes-128-cbc;
}
policy ike-vpn-policy {
    mode aggressive;
    proposals ike-vpn-proposal;
    pre-shared-key ascii-text "SECRET"; ## SECRET-DATA    }
gateway vpn-local-gw {
    ike-policy ike-vpn-policy;
    address AAA.BBB.CCC.DDD;
    dead-peer-detection {
        interval 10;
        threshold 3;
    }
    local-identity hostname vpn.mydomain.com;
    remote-identity hostname reverser.mydomain.com;
    external-interface fe-0/0/7.0;
    version v2-only;
}


proposal ipsec-vpn-proposal {
    protocol esp;
    authentication-algorithm hmac-sha-256-128;
    encryption-algorithm aes-128-cbc;
}
policy ipsec-vpn-policy {
    perfect-forward-secrecy {
        keys group24;
    }
    proposals ipsec-vpn-proposal;
}
vpn vpn {
    bind-interface st0.0;
    ike {
        gateway vpn-local-gw;
        proxy-identity {
            local 192.168.1.0/24;
            remote 192.168.2.0/24;
        }
        ipsec-policy ipsec-vpn-policy;
    }
    establish-tunnels immediately;
}


security-zone trust {
    host-inbound-traffic {
        system-services {
            all;
        }
        protocols {
            all;
        }
    }
    interfaces {
        vlan.100;
    }
}
security-zone untrust {
    screen untrust-screen;
    interfaces {
        fe-0/0/7.0 {
            host-inbound-traffic {
                system-services {
                    dhcp;
                    ike;
                }
            }
        }
    }
}
security-zone vpn {
    interfaces {
        st0.0;
    }
}

SRX IKE and IPsec status:

root@dravis> show security ike security-associations
Index   State  Initiator cookie  Responder cookie  Mode           Remote Address
1402228 UP     3551524e1af4a5e3  9dbc38ed8519f12b  IKEv2          AAA.BBB.CCC.DDD

root@dravis> show security ipsec security-associations
  Total active tunnels: 0

root@dravis> show security ipsec inactive-tunnels
  Total inactive tunnels: 1
  Total inactive tunnels with establish immediately: 1
  ID     Port  Nego#  Fail#  Flag      Gateway          Tunnel Down Reason
  131073 500   8      0      600a29    AAA.BBB.CCC.DDD  Delete payload received

StrongSwan Status:

Status of IKE charon daemon (strongSwan 5.2.1, Linux 3.16.0-4-amd64, x86_64):
  uptime: 92 days, since Aug 24 17:41:13 2016
  malloc: sbrk 1495040, mmap 0, used 312800, free 1182240
  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 2
  loaded plugins: charon aes rc2 sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default stroke updown
Listening IP addresses:
  AAA.BBB.CCC.DDD
  10.10.0.5
  192.168.2.2
Connections:
vpn.mydomain.com:  AAA.BBB.CCC.DDD...vpn.mydomain.com  IKEv2
vpn.mydomain.com:   local:  [reverser.mydomain.com] uses pre-shared key authentication
vpn.mydomain.com:   remote: [vpn.mydomain.com] uses pre-shared key authentication
vpn.mydomain.com:   child:  192.168.2.0/24 === 192.168.1.0/24 TUNNEL
Security Associations (1 up, 0 connecting):
vpn.mydomain.com[941]: ESTABLISHED 2 hours ago, AAA.BBB.CCC.DDD[reverser.mydomain.com]...EEE.FFF.GGG.HHH[vpn.mydomain.com]
vpn.mydomain.com[941]: IKEv2 SPIs: e3a5f41a4e525135_i 2bf11985ed38bc9d_r*, pre-shared key reauthentication in 15 minutes
vpn.mydomain.com[941]: IKE proposal: AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048_256

Answer

Attribution
Source : Link , Question Author : Agrajag9 , Answer Author : Agrajag9