topic Re: Life time settings for phase1 and phase 2 in SASE and Remote Access

Life time settings for phase1 and phase 2

Brianpiraty_Ale — Fri, 29 Jun 2018 16:13:40 GMT

If I have 24 hours on phase 1 and 1 hour on phase 2 , if there is no activity for a while, will the tunnel still up for 24 hours?

Re: Life time settings for phase1 and phase 2

PhoneBoy — Fri, 29 Jun 2018 20:37:41 GMT

The timers are based on when things are initially negotiated.

Phase 1 is for authenticating the endpoints, Phase 2 is for the actual tunnel.

Every hour (assuming there is activity), the Phase 2 tunnel is (re)negotiated.

Every 24 hours (if there is activity), Phase 1 is redone (which requires more CPU).

The one thing you need to make sure is these timers are the same on both ends, or you will have issues.

Re: Life time settings for phase1 and phase 2

Luis1980 — Tue, 23 May 2023 09:38:20 GMT

I am having problems with this between a VPN azure-checkpoint, could you tell me what is the maximum time that can be set.

Re: Life time settings for phase1 and phase 2

the_rock — Tue, 23 May 2023 14:01:53 GMT

For phase 1, maximum value is 70000 minutes, which is almost 49 days and for phase 2, its 86400 seconds, which is 24 hours. Now, keep in mind, even for permanent tunnel, does not always mean it will be up if no traffic. As a matter of fact, from my experience with AWS and Azure, thats usually not the case, unless you initiate traffic.

Cheers,

Andy

Re: Life time settings for phase1 and phase 2

the_rock — Tue, 23 May 2023 14:02:45 GMT

Not necessarily, as a matter of fact, it usually wont be.