<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!-- saved from url=(0014)about:internet -->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta http-equiv="Content-Style-Type" content="text/css" />
    <meta name="GENERATOR" content="Quadralay WebWorks AutoMap 2003 Platinum Edition Client for FrameMaker 8.6.6597.0" />
    <meta name="TEMPLATEBASE" content="emwebh8-1-17" />
    <meta name="LASTUPDATED" content="08/01/13 14:47:55" />
    <title>Global Lifetime Values </title>
    <!-- Copyright 2010-2013, Cisco Systems, Inc. All rights reserved. -->

    <link rel="StyleSheet" href="document.css" type="text/css" />
    <link rel="StyleSheet" href="catalog.css" type="text/css" />


<script> 
    var is_chrome = navigator.userAgent.toLowerCase().indexOf('chrome') > -1; 
   
    if(is_chrome){document.domain=document.domain}
   </script>
    <script type="text/javascript" language="JavaScript1.2" src="expand.js"></script>
    <script type="text/javascript" language="JavaScript1.2" src="page.js"></script>

    <script type="text/javascript" language="JavaScript1.2">
     <!--
      function  WWNoOp() {}
      function  WWNoValue() { return ""; }

      var  VarDropDown;

      if (typeof(HTMLHelp_Object) != "undefined")
      {
        VarDropDown = new WWDropDown_Object();
      }
      else
      {
        VarDropDown = new Object();
        VarDropDown.fAnchorOpen  = WWNoOp;
        VarDropDown.fAnchorClose = WWNoOp;
        VarDropDown.fDIVOpen  = WWNoOp;
        VarDropDown.fDIVClose = WWNoOp;
      }
     // -->
    </script>

  
<SCRIPT language="javascript">
<!--
  self.document.write("<link href='"+top.relPath+"shared/style.css' rel='stylesheet' type='text/css'>");
  myid=1750;
  self.document.write("<script type='text/javascript' language='JavaScript' src='"+top.relPath+"shared/con_utils.js'></scr"+"ipt>");
//-->
</SCRIPT>
</head>

  <body onload="highlightSearchTerms();" bgcolor="#ffffff">

    
    <blockquote>
    <a name="top"></a>

    
    


<a name="wp1077086"> </a><h1 class="pTitle">
Global Lifetime Values

</h1>
<a name="wp1077088"> </a><p class="pBody">
If you have not configured a lifetime in the crypto map entry, the global lifetime values are used when 
negotiating new IPsec SAs. 

</p>
<a name="wp1077089"> </a><p class="pBody">
You can configure two lifetimes: timed or traffic-volume. An SA expires after the first of these lifetimes 
is reached. The default lifetimes are 3,600 seconds (one hour) and 450 GB. 

</p>
<a name="wp1077090"> </a><p class="pBody">
If you change a global lifetime, the new lifetime value will not be applied to currently existing SAs, but 
will be used in the negotiation of subsequently established SAs. If you wish to use the new values 
immediately, you can clear all or part of the SA database. 

</p>
<a name="wp1077091"> </a><p class="pBody">
Assuming that the particular crypto map entry does not have lifetime values configured, when the switch 
requests new SAs it will specify its global lifetime values in the request to the peer; it will use this value 
as the lifetime of the new SAs. When the switch receives a negotiation request from the peer, it uses the 
value determined by the IKE version in use:

</p>
<div class="pSmartList1"><ul class="pSmartList1">
<a name="wp1077092"> </a><li class="pSmartList1">If you use IKEv1 to set up IPsec SAs, the SA lifetime values are chosen to be the smaller of the two 
proposals. The same values are programmed on both the ends of the tunnel.
</li>
<a name="wp1077093"> </a><li class="pSmartList1">If you use IKEv2 to set up IPsec SAs, the SAs on each end have their own set up of lifetime values 
and thus the SAs on both sides expire independently.
</li>
</ul></div>
<a name="wp1077094"> </a><p class="pBody">
The SA (and corresponding keys) will expire according to whichever comes sooner, either after the 
specified amount of time (in seconds) has passed or after the specified amount of traffic (in bytes) has 
passed. 

</p>
<a name="wp1077095"> </a><p class="pBody">
A new SA is negotiated before the lifetime threshold of the existing SA is reached to ensure that 
negotiation completes before the existing SA expires. 

</p>
<a name="wp1077096"> </a><p class="pBody">
The new SA is negotiated when one of the following thresholds is reached (whichever comes first):

</p>
<div class="pSmartList1"><ul class="pSmartList1">
<a name="wp1077097"> </a><li class="pSmartList1">30 seconds before the lifetime expires or
</li>
<a name="wp1077098"> </a><li class="pSmartList1">Approximately 10% of the lifetime in bytes remain
</li>
</ul></div>
<a name="wp1077099"> </a><p class="pBody">
If no traffic has passed through when the lifetime expires, a new SA is not negotiated. Instead, a new SA 
will be negotiated only when IPsec sees another packet that should be protected. 

</p>
<hr /><br><p class="pBody">Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.</p> 

    </blockquote>

  </body>
</html>
