cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
446
Views
0
Helpful
2
Replies
richard.dean
Beginner

Not specifying traffic volume in SA, what happens?

I fI do not specify a security-association lifetime in kilobytes, but do set one up for seconds, what happens? According to this link  http://www.cisco.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ftsaidle.html  it states:

A security association expires after the first of these lifetimes is reached.

What if I do not set one for volume? I would assume that prior to reaching the default amount, it will negotiate a new SA and kick in as the original SA timesout. I also assume the end user would never know it reset. Guidance please.

1 ACCEPTED SOLUTION

Accepted Solutions
Marcin Latosiewicz
Cisco Employee

Richard,

We do recommand to use seconds as the factor for exiry, reaching the end of kilobytes will most likely cause a short gap in forwarding.

With kilobyte lifetime disabled we should wait for the seconds lifetime to come close to expiery and new SA will be negotiated.

"crypto ipsec security-association lifetime kilobytes disa"

Indeed we do have defaults for both.

But we will always renogotiate based on whichever is reached first.

Does that answer your question?

M.

View solution in original post

2 REPLIES 2
Marcin Latosiewicz
Cisco Employee

Richard,

We do recommand to use seconds as the factor for exiry, reaching the end of kilobytes will most likely cause a short gap in forwarding.

With kilobyte lifetime disabled we should wait for the seconds lifetime to come close to expiery and new SA will be negotiated.

"crypto ipsec security-association lifetime kilobytes disa"

Indeed we do have defaults for both.

But we will always renogotiate based on whichever is reached first.

Does that answer your question?

M.

Thanks, it answers my question perfectly.

Create
Recognize Your Peers
Content for Community-Ad