changing the IPSEC sa lifetime

Answered Question
Jan 10th, 2008

Hi,

If I use the

crypto IPSEC security-association lifetime command, doesn't that hold for all clients? I'm trying to change it only for one IPSEC sa and i don't want to interrupt any other already existing VPN clients.

is there a way to set it for just one client?

Thanks!

Lisa G

Correct Answer by srue about 9 years 1 month ago

you can change it under the crypto map configuration for each individual connection. since you didn't state what device your vpn's are terminated on though, i can't give you a specific example.

the command you gave is global, for which there exists a default lifetime already. 'local' lifetimes for individual crypto maps override this value.

also, if two peers differ in their lifetimes during negotiation, they are 'supposed' to choose the smallest value, but still connect.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
srue Thu, 01/10/2008 - 17:30

you can change it under the crypto map configuration for each individual connection. since you didn't state what device your vpn's are terminated on though, i can't give you a specific example.

the command you gave is global, for which there exists a default lifetime already. 'local' lifetimes for individual crypto maps override this value.

also, if two peers differ in their lifetimes during negotiation, they are 'supposed' to choose the smallest value, but still connect.

Actions

This Discussion