The SA_DELETE message in VPN logs, especially when followed by a re-establishment, is a strong indicator that the Security Association (SA) lifetimes for Phase 1 (IKE SA) or Phase 2 (IPsec SA) are mismatched between the Google Cloud HA VPN and the on-premises router. When one side's SA expires, it sends an SA_DELETE message to the peer, which then triggers a rekeying process. If the lifetimes don't match, one side might prematurely terminate the SA, leading to brief disconnections. Ensuring that the IKE parameters (specifically Phase 1 and Phase 2 lifetimes) match the recommended values in the Cloud HA VPN documentation is crucial for stable tunnel operation.

Exact Extract:

"If your VPN tunnel frequently disconnects and reconnects, and you see SA_DELETE messages in your logs, it often indicates a mismatch in the Phase 1 (IKE SA) and Phase 2 (IPsec SA) lifetimes configured on your on-premises VPN gateway and the Cloud VPN gateway."

"For optimal stability, ensure that the IKE lifetime and ESP/IPsec lifetime parameters on your on-premises VPN device exactly match the recommended values provided in the Cloud VPN documentation. Mismatched lifetimes can cause tunnels to rekey prematurely or fall out of sync, leading to temporary disconnections."Reference: Google Cloud VPN Documentation - Troubleshooting VPN issues, Recommended IKE and IPsec settings