Changing IKE policy will cause IPSec tunnel outage?

[kay.kang]

Hi,

I need to change the existing IKE policy(priority ID 1) with different parameter values.

But the IKE policy is already combined with IPSec tunnel already.

As my plan for this, I am going to copy the existing IKE policy to a new one with different priority ID

and replace the existing IKE policy with the new one. 

In this case, I am wondering if this IKE policy replacement will cause the exiting IPSec outage.

[Rob Ingram]

@kay.kang adding a new IKE policy would not affect the existing IPSec SA - so no outage. Create the new IKE policy with a higher priority ID, so if the new IKE policy is not matched for any reason, the IKE SA will still be established using the old IKE policy.