Sense for lifetime of phase 1 and active PFS on phase 2

[krystianstrycharz]

If i set lifetime for phase 1 ISAKMP equal 3600 seconds, has it sense to set PFS and lifetime for phase 2 IPSec equal 3600 seconds? I understand it's sufficently to set only PFS and lifetime of phase 2, because anyhow after 3600 sec. PFS enforces new phase 1 tunnel and new key materials.

Could you refer to this? Thanks for help in advance!

[ajay chauhan]

I do not see any great reason to keep both same for phase -1 and phase -2 . Best practice phase-1 should always be greater than phase-2.

Ajay

[krystianstrycharz]

Ok, what in case when phase1 is greater than phase2? Is it lifetime of phase1 has any meaning? Because when lifetime of phase2 expires then new phase1 is enforced.