Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
I have a couple of queries related to the IPSec VPN and I believe someone would clarify my doubts.
Why IKE Lifetime and IPSec Lifetime is used? Can't we just run the VPN without re-negotiating?
Why re-negotiation in VPN is happening? What is a necessity?
What will happen in re-negotiation? Will it initialize the entire main mode and quick mode messages?
Should IKE Phase 1 timer should match or the lowest will be chosen?
Should IPSec Phase 2 timers should match or the lowest will be chosen?
Why IKE Lifetime and IPSec Lifetime is used? Can't we just run the VPN without re-negotiating? Why re-negotiation in VPN is happening? What is a necessity?
Every key is susceptible to Brute Force. This is unavoidable.
If all you ever use is one key, and an attacker manages to brute force your one key, then all your data that you have ever sent or received is compromised.
To limit the scope of potential compromise, IPsec performs "rekey" operations, so that if a brute force is successful, at best only 8 hours of your data is compromised.
Moreover, the keys used in each direction are different, so if a single key is compromised (which is not trivial), only 8 hours of one side of the conversation is compromised.
What will happen in re-negotiation? Will it initialize the entire main mode and quick mode messages?
When Phase 2 re-keys, Quick mode is performed again.
When Phase 1 re-keys, Main mode is performed again.
Some details of what goes on within Quick mode and Main mode are outlined here:
In IPsec VPN, how is the pre-shared key encrypted?
Should IKE Phase 1 timer should match or the lowest will be chosen? Should IPSec Phase 2 timers should match or the lowest will be chosen?
Between two peers, they agree to use the lowest configured timer. If one peer prefers a 86400 timeout for IKE/Isakmp, and the other prefers 43200, then they both agree to use 43200.
Same for Phase 2.
Why IKE Lifetime and IPSec Lifetime is used? Can't we just run the VPN without re-negotiating?
Why re-negotiation in VPN is happening? What is a necessity?
Yes, in theory you can use the same keys forever. But just like your PC password, it's good practice to change the keys periodically. It keeps "bad guys" from discovering your keys and potentially having access to all your past messages as well as your future messages.
Default ike lifetime is 28800 seconds. Default ipsec lifetime is 3600 seconds.
Keys are renegociated because they can be bruteforced, and then an attacker could decrypt all the captured traffic.
The PFS option allow you to renew the keys without using the old ones, which is more secure.
