Skip to main content
added 25 characters in body
Source Link
Brett Lykins
  • 8.3k
  • 5
  • 37
  • 66
crypto isakmp policy 1
  lifetime 3000<value>
crypto ipsec security-association lifetime [seconds|kilobytes] value<value>
crypto map test<map-mapname> 1<sequence-number> ipsec-isakmp
  set security-association lifetime [seconds|kilobytes] value<value>
crypto isakmp policy 1
  lifetime 3000
crypto ipsec security-association lifetime [seconds|kilobytes] value
crypto map test-map 1 ipsec-isakmp
  set security-association lifetime [seconds|kilobytes] value
crypto isakmp policy 1
  lifetime <value>
crypto ipsec security-association lifetime [seconds|kilobytes] <value>
crypto map <map-name> <sequence-number> ipsec-isakmp
  set security-association lifetime [seconds|kilobytes] <value>
Source Link
Brett Lykins
  • 8.3k
  • 5
  • 37
  • 66

I have been confused by this in the past, so I've tried to break it out for you below.

Phase I Lifetime:

Phase I lifetime on Cisco IOS routers is managed by the global ISAKMP Policy. However this is not a mandatory field, if you do not enter a value, the router will default to 86400 seconds.

crypto isakmp policy 1
  lifetime 3000

To verify the lifetime of a specific policy, you can issue the command show crypto isakmp policy:

TEST-1861#show crypto isakmp policy

Global IKE policy
Protection suite of priority 1
        encryption algorithm:   AES - Advanced Encryption Standard (256 bit keys).
        hash algorithm:         Secure Hash Standard
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #5 (1536 bit)
        lifetime:               86400 seconds, no volume limit

Per Cisco in regards to that show command, (this is only for the isakmp lifetime): "Note that although the output shows "no volume limit" for the lifetimes, you can configure only a time lifetime (such as 86,400 seconds); volume-limit lifetimes are not configurable".


Phase II Lifetime:

Phase II Lifetime can be managed on a Cisco IOS router in two ways: globally or locally on the crypto map itself. As with the ISAKMP lifetime, neither of these are mandatory fields. If you do not configure them, the router defaults the IPSec lifetime to 4608000 kilobytes/3600 seconds.

Global configuration:

crypto ipsec security-association lifetime [seconds|kilobytes] value

This changes the setting for all IPSec SAs on that router.

To verify the global IPSec lifetime, issue the show crypto ipsec security-association lifetime command:

TEST-1861#show crypto ipsec security-association lifetime
Security association lifetime: 4608000 kilobytes/3600 seconds

Crypto Map configuration:

If you need to change the IPSec lifetime for one connection, but not for all others on the router, you can configure the lifetime on the Crypto Map entry:

crypto map test-map 1 ipsec-isakmp
  set security-association lifetime [seconds|kilobytes] value

To verify this individual Crypto Map lifetime value, use the show cyrpto map command (output sniped for clarity):

TEST-1861#show crypto map 
Crypto Map "test-map" 1 ipsec-isakmp
        Peer = 67.221.X.X
        Extended IP access list Crypto-list
            access-list Crypto-list permit ip 172.20.0.0 0.0.0.255 10.0.0.0 0.255.255.255
            access-list Crypto-list permit ip 172.20.0.0 0.0.0.255 192.168.0.0 0.0.255.255
        Current peer: 67.221.X.X
        Security association lifetime: 4608000 kilobytes/3600 seconds

(If you want more info, the Cisco IOS Security Configuration Guide, specifically the sections on Configuring IPSec Network Security and Configuring Internet Key Exchange Security Protocol, go into more detail on the relevant commands.)