ipsec sa global-duration
Function
The ipsec sa global-duration command sets the global hard lifetime of IPSec SAs.
The undo ipsec sa global-duration command restores the default global hard lifetime of IPSec SAs.
By default, the global time-based SA hard lifetime is 3600 seconds and the global traffic-based SA hard lifetime is 1843200 Kbytes.
Parameters
Usage Guidelines
Usage Scenario
For a dynamic SA, configure the SA hard lifetime so that the SA can be updated in real time, reducing the crash risk and improving security.
Time-based lifetime
The period from when an SA is set up to when the SA is expired.
Traffic-based lifetime
The maximum volume of traffic that this SA can process.
Hard lifetime: specifies the lifetime of an IPSec SA.
When two devices negotiate an IPSec SA, the actual hard lifetime is the smaller of the two values configured on the two devices.
Soft lifetime: specifies the time after which a new IPSec SA is negotiated so that the new IPSec SA will be ready before the hard lifetime of the original IPSec SA expires.
Table 20-44 lists the default soft lifetime values.Table 20-44 Soft lifetime valuesSoft Lifetime Type Description Time-based soft lifetime (soft timeout period) The value is 70% of the actual hard lifetime (hard timeout period).
Traffic-based soft lifetime (soft timeout traffic) - For IKEv1, the value is 70% of the actual hard lifetime (hard timeout traffic).
- For IKEv2, the value is 65% to 75% of the actual hard lifetime (hard timeout traffic) plus or minus a random value.
Before an IPSec SA becomes invalid, IKE negotiates a new IPSec SA for the remote end. The remote end uses the new IPSec SA to protect IPSec communication immediately after the new IPSec SA is negotiated. If service traffic is transmitted, the original IPSec SA is deleted immediately. If no service traffic is transmitted, the original IPSec SA will be deleted after 10s or the hard lifetime expires.
If the time-based lifetime and traffic-based lifetime are both set for an IPSec SA, the IPSec SA becomes invalid when either lifetime expires.
Precautions
You only need to specify the SA lifetime for the SA setup through the IKE negotiation. That is, it is invalid to the SA manually set up. The manually set up SA is effective permanently.
The SA lifetime can be configured globally or based on an IPSec policy or profile. If no SA lifetime is configured for the IPSec policy or profile, the global lifetime is used. If both the global SA lifetime and lifetime based on the IPSec policy or profile are configured, the latter one takes effect.
- The responder cannot initiate IPSec SA renegotiation after the IPSec SA soft lifetime expires.
- The initiator cannot initiate IPSec SA renegotiation when its IKE SA is deleted and the IPSec SA soft lifetime expires.
During IKEv2 negotiation, the initiator or responder cannot initiate IPSec SA renegotiation if the IKE SA is deleted and the IPSec SA soft lifetime expires.
