A security association (SA) supports the following types of lifetimes:
The time-based lifetime: the period of time an SA can exist after it is established.
The traffic-based lifetime: the maximum traffic volume that an SA can process.
When the specified time or traffic volume is reached, the SA becomes invalid. When the SA is about to expire, IKE will negotiate a new SA for IPSec. In this manner, a new SA is established when the old SA becomes invalid. Before the new SA is established, the two ends use the old SA to protect data flows. When the new SA is established, the two ends immediately use the new SA.