IPSEc - SA lifetime operation behavior

[cjrchoi11]

I want to clarify the sa lifetime.

If configure seconds and kilobytes both, how it works the lifetime? Is it works based on the early hit? If then, is the SA re-negotiate when the following condition?

1) 24hr and 500K traffic,

2) 4hr and 2M traffic

set security-association lifetime seconds 86399

set security-association lifetime kilobytes 2000

Another question.

Is the following sample will be re-negotiated when 120 seconds or 2M traffic?

RouterA

set security-association lifetime seconds 240

set security-association lifetime kilobytes 10000

RouterB

set security-association lifetime seconds 120

set security-association lifetime kilobytes 2000

Thanks,

[gfullage · Accepted solution]

The first one to run out, either time or kbytes, will cause new SA's to be built. In your question, both 1) and 2) will cause new SA's to be built, one set in 24hours, and one set after 2Meg of traffic has passed.

Keep in mind that the router will build new SA's when either 30 seconds are left on the seconds lifetime, or 256Kbytes are left on the kilobytes lifetime, this is so there's no traffic dropped while new SA's are being built. The new SA's are used as soon as they're up, and the old ones just disappear silently.

For your second question, parameters are negotiated by both ends during the tunnel negotiation. The LOWER values are always used by both peers, so RouterB's parameters would be used.

Read this (http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/c.htm#wp1026972), it answers every question you asked.