Hi,
using ipsec, there are two lifetime values which can be configured:
One is the
/ip ipsec proposal lifetime
and the other is the
/ip ipsec peer lifetime
a) Can some please explain the relationship between these lifetimes values
b) Should the proposal lifetime < peer lifetime
c) Or any other rule here?
Thanks a lot for some expert knowledge.
Achim
Proposal it’s the phase 2 of IPSec and it’s lifetime means when it should renew the SAs used.
Peer it’s the phase 1 of IPSec and it’s lifetime means when it should close the current connection and create a new one.
On the IP / IpSec / Peers you could see the phase 1, and if you double-click one you will see the established time. This one should never be greater than the phase 1 lifetime.
On the Installed SAs tab you have the same but for phase 2.