Lifetime parameter in VPN

[prichetakashyap]

Hi,

I have following query:

Is the lifetime parameter setting should be identical on both side firewall for both Phase-1 and Phase-2? or it can be different?

thnx

[Marwan ALshawi]

not must identical but better, When this lifetime expires, the IPsec peers renegotiate IKE phase 1

Many people choose to leave the IKE SA lifetime at the default value of 86400. It is worth noting, however, that the longer the lifetime, the less secure the SA is. The SA is less secure with a longer lifetime because with a longer lifetime an attacker has more time to collect encrypted traffic and subject it to cryptanalysis (attempt to recover the plaintext). However, a shorter IKE lifetime causes IPsec peers to have to renegotiate IKE more often

please, if helpful Rate

[prichetakashyap]

thanks for the detail but do the re-negotiation affects running ipsec-tunnel? that if tunnel disconnects?

thanks

[Marwan ALshawi]

no dose not effect the running one

please if helpful Rate

[mahesh18]

Hi Marwanshawi,

I was looking for same info which you answered here.

Regards

Mahesh