IPSec lifetimes

[JohnTylerPearce]

I have a customer, who needs to configure a site-to-site vpn with Microsoft Azure. They currently have several site-to-site vpns configured, and according to MS, they have their own IPSec lifetimes, which is different from all of our other VPNs. I really don't want to have to setup a lot of downtime for a customer just for one site-to-site vpn. Is there a way to configure IPSec lifetime parameters for a specific site-to-site VPN, instead of globally.                  

[Jouni Forss · Accepted solution]

Hi,

For ASA the command format could for example be

ASA(config)# crypto map CRYPTO 1 set security-association lifetime ?

configure mode commands/options:

  kilobytes  Security association duration in kilobytes

  seconds    Security association duration in seconds

It would naturally contain also other lines such as

crypto map CRYPTO 1 set peer x.x.x.x

crypto map CRYPTO 1 match address

crypto map CRYPTO 1 set ikev1 transform-set

The "ikev1" parameter came with the new 8.3 and newer software levels as there is now also "ikev2".

The global values to my understanding are configured with the below configuration

ASA(config)# crypto ipsec security-association lifetime ?

configure mode commands/options:

  kilobytes  Lifetime kilobytes

  seconds    Lifetime seconds

- Jouni

[JohnTylerPearce]

Thanks for the quick and educational response. Correct me if I'm wrong, but you can only enable one crypto map per interface right?

[Jouni Forss]

Hi,

Below is a quote from ASA command reference

Usage Guidelines
crypto map interface
Use this command to assign a crypto map set to any active adaptive security appliance interface. The
adaptive security appliance supports IPSec termination on any and all active interfaces. You must assign
a crypto map set to an interface before that interface can provide IPSec services.
You can assign only one crypto map set to an interface. If multiple crypto map entries have the same
map-name but a different seq-num, they are part of the same set and are all applied to the interface. The
adaptive security appliance evaluates the crypto map entry with the lowest seq-num first.

So seems to be that only one crypto map per interface

- Jouni

[Karsten Iwen]

You only have one crypto map per interface, but this one crypto map can contain many sequence-numbers each with a crypto-definition (acl, transform, peer, lifetime ...).


Sent from Cisco Technical Support iPad App