Showing results for 
Search instead for 
Did you mean: 

Information gathered (so far) about SA lifetime and rekeying behavior

CISCO ASA (info as of version 8.3(2)):

  Will initiate Phase 1 rekey at 50% of the negotiated (seconds) lifetime.  Behavior not configurable.

  Will initiate Phase 2 rekey at 95% of the negotiated (seconds) lifetime, but no later than 60 seconds before the SA expires (i.e. if < 1200 seconds negotiated).  Behavior not configurable.

  Will negotiate Phase 1/Phase 2 seconds/KB down to what client requests.

Windows XP:

  Will negotiate down Phase 2 (seconds) lifetime.  (KB behavior untested)

Windows Vista/Win7:

  Will fail initial negotiation if Phase 2 lifetime (seconds or kilobytes) on server is less than on client (will not negotiate down.)

All Windows Native L2TP (RASMAN automatic "IP security policy"):

  Phase 1 lifetime is fixed, non-configurable at 28800 seconds

  Phase 2 lifetime is fixed, non-configurable at 3600 seconds

  Phase 2 KB is fixed, non-configurable at 250000KB

All Windows Native L2TP (RASMAN ProhibitIpSec=1 and manually installed "IP security policy"):

  Phase 2 lifetime (KB and seconds) configurable.

  Will initiate Phase 2 rekey 80 seconds before phase2 SA expiry (behavior not configurable.)

Linux StrongSwan Client:

  Phase 1/Phase 2 lifetime (seconds) configurable, but see below

  Phase 2 "rekeymargin" parameter determines (absolute) time before expiry when client initiates rekey.

  Phase 2 "rekeyfuzz" can add random amounts of time when used in server mode with many connections.

  Care must be taken.  If the margin and fuzz total more than the lifetime, no rekey initiated.

OSX (racoonish) native client:

  still untested

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Quick Links