Configuring IPsec VPN and TTL

Question

I have two sites, each using their own firewall. Once a Cisco Meraki, another a Cisco ASA. The two sites use IPsec to establish a VPN tunnel.

The Question: If each of the two sites have different TTLs on their Phase 1 & 2 configurations, would that interfere with VPN traffic? My thought is if one site times out on their VPN before the other, there might be a connectivity problem. Would it just stop accepting connections, or would it request a new agreement or establish a request for a new tunnel?

An example:

SITE A: P1 -> 86400 P2 -> 2800

SITE B: P1 -> 800 P2-> 600

COMPARE TO CONVENTIONAL SETUP:

SITE A: P1 -> 86400 P2 -> 2800

SITE B: P1 -> 86400 P2 -> 2800

The problem is that the ASA has a basic license for IPsec only allowing 10 concurrent sessions, but we have 15-20 configured tunnels on the ASA. We have the potential of exceeding the 10 concurrent limit.

We want to decrease the TTL to reduce the chance of hitting the limit. The problem is we only have the ability to do this one site.

Answer 1

Both sides should have the same key lifetime(!) for each phase for smooth operation. The phase 2 interval should not be larger than phase 1, usually it's much smaller (phase 1: 4-24 h, phase 2: .5-12 h).

The key lifetime, sometimes called key TTL, doesn't necessarily timeout the session. You'll want to activate dead peer detection (DPD) for that.