Chapter 16. Managing Networks and Traffic
196
Note
When PFS is turned on, for every negotiation of a new phase-2 SA the two gateways must
generate a new set of phase-1 keys. This adds an extra layer of protection that PFS adds,
which ensures if the phase-2 SA’s have expired, the keys used for new phase-2 SA’s have
not been generated from the current phase-1 keying material.
•IKE Lifetime (seconds): The phase-1 lifetime of the security association in seconds. Default is
86400 seconds (1 day). Whenever the time expires, a new phase-1 exchange is performed.
•ESP Lifetime (seconds): The phase-2 lifetime of the security association in seconds. Default is
3600 seconds (1 hour). Whenever the value is exceeded, a re-key is initiated to provide a new
IPsec encryption and authentication session keys.
•Dead Peer Detection: A method to detect an unavailable Internet Key Exchange (IKE) peer.
Select this option if you want the virtual router to query the liveliness of its IKE peer at regular
intervals. It’s recommended to have the same configuration of DPD on both side of VPN
connection.
5. Click OK.

Updating and Removing a VPN Customer Gateway

You can update a customer gateway either with no VPN connection, or related VPN connection is in
error state.
1. Log in to the CloudPlatform UI as an administrator or end user.
2. In the left navigation, choose Network.
3. In the Select view, select VPN Customer Gateway.
4. Select the VPN customer gateway you want to work with.
5. To modify the required parameters, click the Edit VPN Customer Gateway button
6. To remove the VPN customer gateway, click the Delete VPN Customer Gateway button
7. Click OK.
16.24.4.2. Creating a VPN gateway for the VPC
1. Log in to the CloudPlatform UI as an administrator or end user.
2. In the left navigation, choose Network.
3. In the Select view, select VPC.
All the VPCs that you have created for the account is listed in the page.
4. Click the Configure button of the VPC to which you want to deploy the VMs.