0

I have two sites, each using their own firewall. Once a Cisco Meraki, another a Cisco ASA. The two sites use IPsec to establish a VPN tunnel.

The Question: If each of the two sites have different TTLs on their Phase 1 & 2 configurations, would that interfere with VPN traffic? My thought is if one site times out on their VPN before the other, there might be a connectivity problem. Would it just stop accepting connections, or would it request a new agreement or establish a request for a new tunnel?

An example:

SITE A: P1 -> 86400 P2 -> 2800

SITE B: P1 -> 800 P2-> 600

COMPARE TO CONVENTIONAL SETUP:

SITE A: P1 -> 86400 P2 -> 2800

SITE B: P1 -> 86400 P2 -> 2800

The problem is that the ASA has a basic license for IPsec only allowing 10 concurrent sessions, but we have 15-20 configured tunnels on the ASA. We have the potential of exceeding the 10 concurrent limit.

We want to decrease the TTL to reduce the chance of hitting the limit. The problem is we only have the ability to do this one site.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 9:00
2

Both sides should have the same key lifetime(!) for each phase for smooth operation. The phase 2 interval should not be larger than phase 1, usually it's much smaller (phase 1: 4-24 h, phase 2: .5-12 h).

The key lifetime, sometimes called key TTL, doesn't necessarily timeout the session. You'll want to activate dead peer detection (DPD) for that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.