sa keep-holding-to hard-duration
Function
The sa keep-holding-to hard-duration command configures the device to delete the original IPSec SA after the hard lifetime expires during IPSec SA re-negotiation.
The undo sa keep-holding-to hard-duration command configures the device to delete the original IPSec SA immediately after it uses the new IPSec SA to transmit data during IPSec SA re-negotiation.
By default, during IPSec SA re-negotiation, the device deletes the original IPSec SA immediately after using the new IPSec SA to transmit data.
Usage Guidelines
Usage Scenario
After a new IPSec SA is negotiated, if the peer device still uses the original IPSec SA to transmit data while the local device deletes the original IPSec SA immediately after using the new IPSec SA to transmit data, the IPSec SAs on the two devices will be different. This will cause IPSec traffic interruption. In this case, you are advised to run the sa keep-holding-to hard-duration command to enable the local device to delete the original IPSec SA after the hard lifetime expires.
Precautions
This command takes effect only for IPSec SAs established through IKEv1 negotiation.
