crypto ipsec security-association lifetime

[Eduard A.]

Hi,

Where can I change the "crypto ipsec security-association lifetime" in a Cisco ASA5508-X Threat Defense and/or Cisco ASA5516-X Threat Defense? If it is possible at all. Or at least please help me find out what is default for those models. Thank you so much!

[Marvin Rhoads]

It's 28800 seconds, non-configurable if using FDM or CDO management.

With FMC you can change it under Objects > Object Management > VPN and IKEv1 Policy. Then associate the configured policy object within your VPN configuration.

[Eduard A.]

You maybe right on this one but we can't be sure because this is what debug shows me:

As you know we have hub (asdm) and spoke (3 spokes,ftd) topology. HUB(5545), SPK1(5516), SPK2(5516), SPK3(5508). Now here's the thing:

HUB is set to:

crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000

With the help of debug logs I found that, if the traffic originated from:

HUB, the lifetime in seconds is 24480

SPK1, it is 24480

SPK2, it is 24480

but in SPK3, it is 27360

That's why I've concluded that I am bumping to ipsec lifetime mismatch. The problem with our network was "accurately" describe here by the Cisco employee:

https://community.cisco.com/t5/vpn/ipsec-security-association-sa-lifetime-mismatch/td-p/739288

Now I did try to change the lifietime on the HUB side (hopefully to force SPK3 to have match 24480, though I know that if there's a mismatch in the first place you can never be sure), but any lifetime I choose SPK3 always end up using a higher one. I do not know how come SPK1 and 2 matches with our HUB since they are FTD, I can only assume at this moment that I had a bad luck choosing 5508 on one of the spokes. Unless I am missing something here?

[Mohammed al Baqari]

Yes you can do this.

Devices > VPN > Site To Site. Then Add VPN > Firepower Threat Defense Device,
or edit a listed VPN Topology. Open the IKE tab.

Then under FTD VPN IPsec Options you can configure lifetime (seconds or
kilobytes)

**** please remember to rate useful posts

[Eduard A.]

You maybe describing a later versions of FTD with FDM? Ours are at least 6.4, as of the moment I do not see anywhere a setting about ipsec lifetimes.