×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

changing the IPSEC sa lifetime

Answered Question
Jan 10th, 2008
User Badges:

Hi,

If I use the

crypto IPSEC security-association lifetime command, doesn't that hold for all clients? I'm trying to change it only for one IPSEC sa and i don't want to interrupt any other already existing VPN clients.


is there a way to set it for just one client?


Thanks!

Lisa G

Correct Answer by srue about 9 years 7 months ago

you can change it under the crypto map configuration for each individual connection. since you didn't state what device your vpn's are terminated on though, i can't give you a specific example.

the command you gave is global, for which there exists a default lifetime already. 'local' lifetimes for individual crypto maps override this value.

also, if two peers differ in their lifetimes during negotiation, they are 'supposed' to choose the smallest value, but still connect.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
srue Thu, 01/10/2008 - 17:30
User Badges:
  • Blue, 1500 points or more

you can change it under the crypto map configuration for each individual connection. since you didn't state what device your vpn's are terminated on though, i can't give you a specific example.

the command you gave is global, for which there exists a default lifetime already. 'local' lifetimes for individual crypto maps override this value.

also, if two peers differ in their lifetimes during negotiation, they are 'supposed' to choose the smallest value, but still connect.

Actions

This Discussion