Getting Cisco ISAKMP and IPSec SA lifetime confused

Question

I always get confused about security association lifetime configuration on Cisco IOS.

On most web-managed hardware it is clear which SA lifetime is for Phase I and which is for Phase II.

On Cisco however you got this crypto isakmp policy <NUM> section where you specify SA lifetime as lifetime <NUM>.

You also have to set SA lifetime in crypto map <NAME> <NUM> IPsec-isakmp section like set security-association lifetime seconds <NUM>.

Could you, guys, enlighten me please and end my confusion at last, please? Which one is Phase I and which one is Phase II?

Answer 1

I have been confused by this in the past, so I've tried to break it out for you below.

Phase I Lifetime:

Phase I lifetime on Cisco IOS routers is managed by the global ISAKMP Policy. However this is not a mandatory field, if you do not enter a value, the router will default to 86400 seconds.

crypto isakmp policy 1
  lifetime <value>

To verify the lifetime of a specific policy, you can issue the command show crypto isakmp policy:

TEST-1861#show crypto isakmp policy

Global IKE policy
Protection suite of priority 1
        encryption algorithm:   AES - Advanced Encryption Standard (256 bit keys).
        hash algorithm:         Secure Hash Standard
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #5 (1536 bit)
        lifetime:               86400 seconds, no volume limit

Per Cisco in regards to that show command, (this is only for the isakmp lifetime): "Note that although the output shows "no volume limit" for the lifetimes, you can configure only a time lifetime (such as 86,400 seconds); volume-limit lifetimes are not configurable".

---

Phase II Lifetime:

Phase II Lifetime can be managed on a Cisco IOS router in two ways: globally or locally on the crypto map itself. As with the ISAKMP lifetime, neither of these are mandatory fields. If you do not configure them, the router defaults the IPSec lifetime to 4608000 kilobytes/3600 seconds.

Global configuration:

crypto ipsec security-association lifetime [seconds|kilobytes] <value>

This changes the setting for all IPSec SAs on that router.

To verify the global IPSec lifetime, issue the show crypto ipsec security-association lifetime command:

TEST-1861#show crypto ipsec security-association lifetime
Security association lifetime: 4608000 kilobytes/3600 seconds

Crypto Map configuration:

If you need to change the IPSec lifetime for one connection, but not for all others on the router, you can configure the lifetime on the Crypto Map entry:

crypto map <map-name> <sequence-number> ipsec-isakmp
  set security-association lifetime [seconds|kilobytes] <value>

To verify this individual Crypto Map lifetime value, use the show cyrpto map command (output sniped for clarity):

TEST-1861#show crypto map 
Crypto Map "test-map" 1 ipsec-isakmp
        Peer = 67.221.X.X
        Extended IP access list Crypto-list
            access-list Crypto-list permit ip 172.20.0.0 0.0.0.255 10.0.0.0 0.255.255.255
            access-list Crypto-list permit ip 172.20.0.0 0.0.0.255 192.168.0.0 0.0.255.255
        Current peer: 67.221.X.X
        Security association lifetime: 4608000 kilobytes/3600 seconds

---

(If you want more info, the Cisco IOS Security Configuration Guide, specifically the sections on Configuring IPSec Network Security and Configuring Internet Key Exchange Security Protocol, go into more detail on the relevant commands.)