topic Is it ok to set ipsec phase 1 lifetime 24 hours when the peer set it to 86400 secs? in General Topics

Is it ok to set ipsec phase 1 lifetime 24 hours when the peer set it to 86400 secs?

yhlee1 — Wed, 26 Dec 2018 07:13:03 GMT

Hello

I made ipsec tunnel between paloalto and fortigate.

I keep have issue about rekeying, so I try to set different lifetime phase 1 and 2.

phase 1 : 28800 -> 86400

phase 2 : 28800 -> 28800

In paloalto I can't set 86400 sec, so I plan to set it 24 hours.

Is it okay to set it that way? Because fortigate will set the value to 86400 sec.

Re: Is it ok to set ipsec phase 1 lifetime 24 hours when the peer set it to 86400 secs?

pulukas — Wed, 26 Dec 2018 10:02:00 GMT

The lifetime values really should be the same. You should ask the other side if they are able to set something that is available on the PAN.

Tunnels do sometimes work with different lifetimes set. But the operations can be inconsistent and have problems like suddently stop passing traffic when one side or the other lifetime expires.

Re: Is it ok to set ipsec phase 1 lifetime 24 hours when the peer set it to 86400 secs?

yhlee1 — Wed, 26 Dec 2018 12:36:56 GMT

Thanks for your answer,

Because the values are same duration, so I guess it's fine but I'm not sure..

In some blog or article on internet, they set the values to hour-second.

Hope it'll work well