identical policy but with a different Lifetime

[smetieh001]

I'm wondering if it's possible to create an identical policy (3 &4) but with different Lifetime? see below.

isakmp policy 3

authen pre-share

encrypt Aes

hash sha

group 1

lifetime 24600

isakmp policy 4

authen pre-share

encrypt Aes

hash sha

group 1

lifetime 26600

Thanks

[Jouni Forss · Accepted solution]

Hi,

I dont see a reason why you couldnt do this.

For example from my own ASA (just to show that its possible)

• Policy 10 and 11 are identical in other ways other than lifetime
• Policy 10 and 20 are actually identical in every way other than the priority (10 and 20)

crypto ikev1 policy 10

authentication pre-share

encryption aes-256

hash sha

group 2

lifetime 28800

crypto ikev1 policy 11

authentication pre-share

encryption aes-256

hash sha

group 2

lifetime 28810

crypto ikev1 policy 20

authentication pre-share

encryption aes-256

hash sha

group 2

lifetime 28800

The configuration format is slightly different than the above as I am using newer software.

Hope this helps

- Jouni

[smetieh001]

Thanks Jouni. thought so too just wanted to be sure.

[smetieh001]

Jouni,

Any reason why you have identical phase 1 policy? just curious...

[Jouni Forss]

Hi,

The only reason its configured was to show to you that even that is possible.

I just configured on my ASA before I answered. In a real situation ofcourse I wouldnt need to have 2 identical policys. The highest policy number would never be applied/matched in a VPN negotiation.

They are gone in through from the lowest to the highest value during VPN negotiations.

- Jouni

[smetieh001]

yeah.. Thanks

[Jouni Forss]

No problem,

Please mark the question as answered if it did

- Jouni