What does this mean : Overriding Initiator's IPSec rekeying duration from 0 to 4608000 Kbs

[PacketSpartan]

Hi Guys

Can someone tell me what this message from the ASA means 

What does this mean : Overriding Initiator's IPSec rekeying duration from 0 to 4608000 Kbs

I've seen the messages with Overriding Initiator's IPSec rekeying duration from 28800 to 3600 seconds, which clear and obvious as its showing in seconds. 

Could some elaborate on the above message?

[Rob Ingram · Accepted solution]

Hi,
The IPSec SA has 2 lifetime values; time in seconds (default 28,800) and data/traffic volume in kilobytes (default 4,608,000). When a peer receives a negotiation request, it uses the smaller of either the lifetime value the peer proposes or the locally configured lifetime value as the lifetime of the new SA. The SA expires after the first of these lifetimes is reached.

Your error indicates your devices have a different value configured for data volume. The other device was initiator of the tunnel is probably set to "unlimited" for lifetime kilobytes. Nowadays it is recommended to not use a data volume lifetime, as if a VPN is heavily used it could be rekeying often. Just using a lifetime in seconds is acceptable.

Disable data volume lifetime using the following command, set on both peers:

crypto map CRYPTO-MAP 1 set security-association lifetime kilobytes unlimited

HTH

[PacketSpartan]

Thank you very much,  just the answer I was looking for