can I change IKE,Transform set... without affecting IPSEC tunnels?

[zhichao]

Hi

In the production network, can I change the IPSEC parameters, e.g. SA life time, Pre-shared key, etc...? Will these affect the tunnels?

[gfullage · Accepted solution]

You can change them, they won't be used until the tunnel is rebuilt (every 1 hour by default for Phase 2 SA's, and every 24 hours for Phase 1). Make sure you change them on both sides of the tunnel though so they match up.