Meaning of SA message " Key Exchange number 31 occurred for user with NCIP"?

[greenmug_]

I'm investigating an issue of slow NC access for users where there are multiple connections from the same remote location (and therefore external IP). One line of investigation is a large number of user access log entries such as:

Key Exchange number 31 occurred for user with NCIP 10.....

What does the message mean exactly?

What situation would lead to multiples of this message appearing in the logs?

Thanks

Ian.

[kenlars_]

Under your ESP setting on the NC Connection profiles, you specify a key lifetime. This message denotes that the key lifetime is expiring and the two sides have established a new key.

Ken

[Mrkool_]

i use the key exhchange message to find out how long the user was actually connected for. there is a 12 min gap between each key exchange by default. so 31 key exhchanges means the user started his NC session 12x31= 372 minutes ago

[Inyoka_]

Just to put a link to the appropriate KB article: http://kb.pulsesecure.net/KB14856

[rdit_]

384 minutes ago, cause the first key exchange happens after 12 minutes, right? ;-)