IPSEC lifetime negotiations

[sandevsingh]

Hi, when the SA lifetime-negogation expires, and a new SA is formed so does it start from the very beginning i.e first IKE-phase1 (Main mode) and then Phase 2(quick mode) or is it just that phase 2 is re-negotiated?

What is the default behavior without using PFS?

[Ivan Martinon]

The devices should only negotiate a new phase 2 key leaving the IKE phase intact, only when IKE goes down is when you will recreate both phases from scratch.

[sandevsingh]

Thanks.