sa duration (ISAKMP IPSec policy view, IPSec policy template view, IPSec profile view)
Function
The sa duration command sets the hard lifetime of IPSec SAs in an IPSec policy or profile.
The undo sa duration command restores the default configuration.
By default, the hard lifetime of IPSec SAs is not configured in an IPSec policy or profile. The system uses the global hard lifetime of IPSec SAs.
Parameters
| Parameter | Description | Value |
|---|---|---|
| traffic-based kilobytes | Specifies the traffic-based SA hard lifetime. It is recommended that the traffic volume be equal to or larger than the size of IPSec traffic forwarded in 1 hour. |
The value is 0 or an integer from 256 to 200000000, in Kbytes.
During IPSec negotiation between a Huawei device and a Cisco device using IKEv1:
|
| time-based seconds | Specifies the time-based SA hard lifetime. When a large number of IPSec tunnels are established between two devices, you are advised to set the IPSec SA hard lifetime to a value larger than or equivalent to 1800s. |
The value is an integer that ranges from 30 to 604800, in seconds. |
Usage Guidelines
Usage Scenario
For a dynamic SA, configure the SA hard lifetime so that the SA can be updated in real time, reducing the crash risk and improving security.
Time-based lifetime
The period from when an SA is set up to when the SA is expired.
Traffic-based lifetime
The maximum volume of traffic that this SA can process.
Hard lifetime: specifies the lifetime of an IPSec SA.
When two devices negotiate an IPSec SA, the actual hard lifetime is the smaller of the two values configured on the two devices.
Soft lifetime: specifies the time after which a new IPSec SA is negotiated so that the new IPSec SA will be ready before the hard lifetime of the original IPSec SA expires.
Table 20-49 lists the default soft lifetime values.Table 20-49 Soft lifetime valuesSoft Lifetime Type Description Time-based soft lifetime (soft timeout period) The value is 70% of the actual hard lifetime (hard timeout period).
Traffic-based soft lifetime (soft timeout traffic) - For IKEv1, the value is 70% of the actual hard lifetime (hard timeout traffic).
- For IKEv2, the value is 65% to 75% of the actual hard lifetime (hard timeout traffic) plus or minus a random value.
Before an IPSec SA becomes invalid, IKE negotiates a new IPSec SA for the remote end. The remote end uses the new IPSec SA to protect IPSec communication immediately after the new IPSec SA is negotiated. If service traffic is transmitted, the original IPSec SA is deleted immediately. If no service traffic is transmitted, the original IPSec SA will be deleted after 10s or the hard lifetime expires.
If the time-based lifetime and traffic-based lifetime are both set for an IPSec SA, the IPSec SA becomes invalid when either lifetime expires.
Precautions
The SA lifetime can be configured globally (ipsec sa global-duration) or based on an IPSec policy or profile. If no SA lifetime is configured for the IPSec policy or profile, the global lifetime is used. If both the global SA lifetime and lifetime based on the IPSec policy or profile are configured, the latter one takes effect.
You only need to specify the SA lifetime for the SA setup through the IKE negotiation. That is, it is invalid to the SA manually set up. The manually set up SA is effective permanently.
- The responder cannot initiate IPSec SA renegotiation after the IPSec SA soft lifetime expires.
- The initiator cannot initiate IPSec SA renegotiation when its IKE SA is deleted and the IPSec SA soft lifetime expires.
During IKEv2 negotiation, the initiator or responder cannot initiate IPSec SA renegotiation if the IKE SA is deleted and the IPSec SA soft lifetime expires.
Example
# Set the IPSec SA hard lifetime in IPSec policy policy1 to 7200 seconds.
<AC6605> system-view [AC6605] ipsec policy policy1 1 isakmp [AC6605-ipsec-policy-isakmp-policy1-1] sa duration time-based 7200
# Set the IPSec SA hard lifetime in IPSec policy policy2 to 20000 KB.
<AC6605> system-view [AC6605] ipsec policy policy2 1 isakmp [AC6605-ipsec-policy-isakmp-policy2-1] sa duration traffic-based 20000
# Set the IPSec SA hard lifetime in IPSec profile profile1 to 7200 seconds.
<AC6605> system-view [AC6605] ipsec profile profile1 [AC6605-ipsec-profile-profile1] sa duration time-based 7200
# Set the IPSec SA hard lifetime in IPSec profile profile1 to 20000 KB.
<AC6605> system-view [AC6605] ipsec profile profile1 [AC6605-ipsec-profile-profile1] sa duration traffic-based 20000
