New IPSec SAs what are decision criterios

[andre.frost]

Hi

when IPSec SAs lifetimes over new SAs are etablished but only if traffice is happens, what are the thresholds or how is decided if new SAs are established and how to change this,

does anybody knows a dokument, I had one on CCO but I cannot find it again

[mmellet]

Use ‘set security-association lifetime {seconds | kilobytes}’ to change the defaults.

[andre.frost]

I know that, but the question is another.

When this lifetime expires, under which circumstances is a new sa creates or not ?

[mmellet]

It’s probably defined in an RFC somewhere. I couldn’t find it at a glance. You might check with your Cisco rep.