Take the 2-minute tour ×
Network Engineering Stack Exchange is a question and answer site for network engineers. It's 100% free, no registration required.

I always get confused about security association lifetime configuration on Cisco IOS.

On most web-managed hardware it is clear which SA lifetime is for Phase I and which is for Phase II.

On Cisco however you got this crypto isakmp policy <NUM> section where you specify SA lifetime as lifetime <NUM>.

You also have to set SA lifetime in crypto map <NAME> <NUM> IPsec-isakmp section like set security-association lifetime seconds <NUM>.

Could you, guys, enlighten me please and end my confusion at last, please? Which one is Phase I and which one is Phase II?

share|improve this question

1 Answer 1

up vote 10 down vote accepted

I have been confused by this in the past, so I've tried to break it out for you below.

Phase I Lifetime:

Phase I lifetime on Cisco IOS routers is managed by the global ISAKMP Policy. However this is not a mandatory field, if you do not enter a value, the router will default to 86400 seconds.

crypto isakmp policy 1
  lifetime <value>

To verify the lifetime of a specific policy, you can issue the command show crypto isakmp policy:

TEST-1861#show crypto isakmp policy

Global IKE policy
Protection suite of priority 1
        encryption algorithm:   AES - Advanced Encryption Standard (256 bit keys).
        hash algorithm:         Secure Hash Standard
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #5 (1536 bit)
        lifetime:               86400 seconds, no volume limit

Per Cisco in regards to that show command, (this is only for the isakmp lifetime): "Note that although the output shows "no volume limit" for the lifetimes, you can configure only a time lifetime (such as 86,400 seconds); volume-limit lifetimes are not configurable".


Phase II Lifetime:

Phase II Lifetime can be managed on a Cisco IOS router in two ways: globally or locally on the crypto map itself. As with the ISAKMP lifetime, neither of these are mandatory fields. If you do not configure them, the router defaults the IPSec lifetime to 4608000 kilobytes/3600 seconds.

Global configuration:

crypto ipsec security-association lifetime [seconds|kilobytes] <value>

This changes the setting for all IPSec SAs on that router.

To verify the global IPSec lifetime, issue the show crypto ipsec security-association lifetime command:

TEST-1861#show crypto ipsec security-association lifetime
Security association lifetime: 4608000 kilobytes/3600 seconds

Crypto Map configuration:

If you need to change the IPSec lifetime for one connection, but not for all others on the router, you can configure the lifetime on the Crypto Map entry:

crypto map <map-name> <sequence-number> ipsec-isakmp
  set security-association lifetime [seconds|kilobytes] <value>

To verify this individual Crypto Map lifetime value, use the show cyrpto map command (output sniped for clarity):

TEST-1861#show crypto map 
Crypto Map "test-map" 1 ipsec-isakmp
        Peer = 67.221.X.X
        Extended IP access list Crypto-list
            access-list Crypto-list permit ip 172.20.0.0 0.0.0.255 10.0.0.0 0.255.255.255
            access-list Crypto-list permit ip 172.20.0.0 0.0.0.255 192.168.0.0 0.0.255.255
        Current peer: 67.221.X.X
        Security association lifetime: 4608000 kilobytes/3600 seconds

(If you want more info, the Cisco IOS Security Configuration Guide, specifically the sections on Configuring IPSec Network Security and Configuring Internet Key Exchange Security Protocol, go into more detail on the relevant commands.)

share|improve this answer
    
Wow, thanks!!! That really clarified some things for me. I have one more question: will ISAKMP SA or IPsec SA form if there's a mismatch in SA lifetime? –  Alex Mar 4 at 14:04
    
@Alex do you mean a mismatch between the two peers creating the connection, or a mismatch between the ISAKMP and IPSec timers on the router itself? –  Brett Lykins Mar 4 at 17:42
    
I mean between two peers –  Alex Mar 5 at 5:51
1  
Short answer, yes the SA will form, if a specific set of other circumstances are met. Longer answer, this is a whole different question, and I recommend asking it separately, and I'd gladly bang out a more detailed answer for you. :) –  Brett Lykins Mar 6 at 13:37
    
Thank you! I think I actually will ask that in a few days' time :) –  Alex Mar 6 at 13:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.