1

Under what conditions are IPSEC P2 SA's built, broken down, and/or re-created?

I'm trying to root out the science under the phase 2 SA creation and mechanics so I can answer for myself what is the most efficient way to design our VPN tunnels. I always get subjective answers when I've asked before, so I'm coming at it different asking about HOW they work at a granular level. Thanks in advance.

Improve this question
0
3

At a basic level, they are created when a traffic flow matching the ACL is first active. It will be torn down either after an idle timeout, or at the end of the "lifetime" of the SA (which could be due to bytes or time.) If the SA expires while traffic is flowing, a new SA is setup -- ie. key renegotiated.

Improve this answer
4
  • So if I have a crypto ACL that is 'any any' - and am filtering only a few IP flows to be allowed across, that's technically the most efficient, because only ever one P2 SA will be built right? – A L Aug 1 '14 at 19:07
  • Right. That would be one SA and your routing processes control what crosses it. (that's similar to how everyone does SSLVPN these days.) – Ricky Aug 1 '14 at 19:11
  • See that makes sense to me, which is why I couldn't understand your reply in this Q: networkengineering.stackexchange.com/questions/10245/… – A L Aug 1 '14 at 19:14
  • Where you said outright ASA doesn't allow 'any' rule for crypto ACL. – A L Aug 1 '14 at 19:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.