ISAKMP lifetime

[Mickael.S]

Hello all,

I am creating a script to simulate the traffic in my isakmp. For this, I am looking for the lifetime of the isakmp tunnel so that I can align myself correctly with it to keep it active and avoid it deactivating after a while.

Where can I find its lifetime? I tried the command ''show crypto isakmp policy'' but I don't know if this is the right place.

Thanks in advance for your answer

Mickaël.

[Karsten Iwen · Accepted solution]

"show crypto isakmp policy" is the right place to see your configured lifetime. But it is negotiated with the peer so it could be lower. With "show crypto isakmp sa detail" you can see the remaining lifetime and in the debug you see what got negotiated.

With IKEv2 it's getting a little more complex as both peers can have individual lifetimes.

If you want to keep the tunnel up, just trigger your traffic frequently.

[Mickael.S]

Hello,

I appreciate you answering me,

Okay, I see.
Thank you for your reply.

[Sheraz.Salim]

Just to add on this what Karsten said. if you running isakmp version 1 in this case lower lifetime vaule will have a priority between two peers. let say site A router isakmp lifetime set as 8600 and site B router isakmp lifetime is 2200. in this case the lower value have priority and SiteA router will adjust itself to SiteB. either if Site A is the vpn-tunnel initatior or responder.

if running the isakmp version 2 in that case lifetime does not matter.