![](/images/new-backgrounds/1188177/188177273x1.webp)
Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-7
the Phase 1 SAs under which they were created. Phase 2 SAs “dangle” when the Phase 1 SA under which they were created expires before they do. There is no requirement that the Phase 1 SA exist for the duration of the Phase 2 SA’s lifetime, but it is convenient because a Delete message may be sent.
■The two SA Lifetime items specify the lifetime associated with each Phase 1 SA and control when the SA will expire and become invalid.
■Phase 1 SA Lifetime (seconds) specifies the duration in seconds for which the SA will remain valid. The range of permissible values is the set of
■Phase 1 SA Lifetime (Kbytes) specifies the maximum number of kilobytes of data that may be secured (encrypted/decrypted or authenticated) using the SA before it expires and becomes invalid. The range of permissible values is the set of
Note: It is invalid to set both lifetime values to zero. This condition is not enforced by the console (in order to avoid order dependencies when configuring the items), but will set defaults at runtime.
■Send Initial Contact Message toggles whether or not the IKE negotiation process begins by sending an initial contact message. The default is Yes.
■Include
■Independent Phase 2
■Strict Port Policy toggles whether or not IKE requires packets to originate from the IANA IKE port (500). Set to Yes, the router will listen only to port 500 and source its packets from port 500. Set to No, the router will return traffic to whatever port originated it.