I Came across incident where i need to troubleshoot IPSEC Site to Site connectivity issue . The term "lifetime" confuses me . please anyone explain me importance of lifetime in VPN . Whats its function . How its effect traffic flow of site to site VPN between peers.

  • key lifetime?
    – Zac67
    Sep 8 '20 at 18:38
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 17 '20 at 21:16

Both IPSEC and ISAKMP create security associations (SA), which are a logical relationship between the peers specifying an encryption key. The lifetime indicates how long these associations last before they are renegotiated. When the SA is created, an encryption key is created for that SA. At the end of the lifetime, the SA is renegotiated and a new key is generated.

The purpose of lifetimes is to limit the damage if an attacker discovers the key. If the key changes periodically, the attacker will only be able to decrypt a (small) portion of the data while that key is valid.

  • Thanks for answers . But when this lifetime will get triggered for new SA associations with peer . it depends on traffic in tunnel or when lifetime expires . when there is continuous traffic in VPN tunnel still lifetime will get triggered or when ... Sep 9 '20 at 13:39
  • It depends on the particular implementation. On most routers, you can choose either one.
    – Ron Trunk
    Sep 9 '20 at 13:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.