- IPsec Anti-Replay Window Expanding and Disabling
- Pre-Fragmentation for IPsec VPNs
- Invalid Security Parameter Index Recovery
- IPsec Dead Peer Detection Periodic Message Option
- IPsec NAT Transparency
- DF Bit Override Functionality with IPsec Tunnels
- Crypto Access Check on Clear-Text Packets
- IPsec Security Association Idle Timers
- Low Latency Queueing for IPsec Encryption Engines
- Finding Feature Information
- Prerequisites for IPsec Security Association Idle Timers
- Information About IPsec Security Association Idle Timers
- How to Configure IPsec Security Association Idle Timers
- Configuration Examples for IPsec Security Association Idle Timers
- Additional References
- Feature Information for IPsec Security Association Idle Timers
IPsec Security Association Idle Timers
When a router running the Cisco IOS software creates an IPsec security association (SA) for a peer, resources must be allocated to maintain the SA. The SA requires both memory and several managed timers. For idle peers, these resources are wasted. If enough resources are wasted by idle peers, the router could be prevented from creating new SAs with other peers.
With the introduction of the IPsec Security Association Idle Timers feature, there is now an idle timer that can be configured to monitor SAs for activity, allowing SAs for idle peers to be deleted and new SAs to be created as required to increase the availability of resources. This feature also improves the scalability of Cisco IOS IPsec deployments.
- Finding Feature Information
- Prerequisites for IPsec Security Association Idle Timers
- Information About IPsec Security Association Idle Timers
- How to Configure IPsec Security Association Idle Timers
- Configuration Examples for IPsec Security Association Idle Timers
- Additional References
- Feature Information for IPsec Security Association Idle Timers
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information Table at the end of this document.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Prerequisites for IPsec Security Association Idle Timers
You must configure Internet Key Exchange (IKE) as described in Internet Key Exchange for IPsec VPNs
Information About IPsec Security Association Idle Timers
Lifetimes for IPsec Security Associations
The Cisco IOS software currently allows the configuration of lifetimes for IPsec SAs. Lifetimes can be configured globally or per crypto map. There are two lifetimes: a "timed" lifetime and a "traffic-volume" lifetime. A security association expires after the first of these lifetimes is reached.
IPsec Security Association Idle Timers
The IPsec SA idle timers are different from the global lifetimes for IPsec SAs. The expiration of the global lifetime is independent of peer activity. The IPsec SA idle timer allows SAs associated with inactive peers to be deleted before the global lifetime has expired.
If the IPsec SA idle timers are not configured, only the global lifetimes for IPsec SAs are applied. SAs are maintained until the global timers expire, regardless of peer activity.
 Note |
If the last IPsec SA to a given peer is deleted due to idle timer expiration, the Internet Key Exchange (IKE) SA to that peer will also be deleted. |
How to Configure IPsec Security Association Idle Timers
Configuring the IPsec SA Idle Timer Globally
This task configures the IPsec SA idle timer globally. The idle timer configuration will be applied to all SAs.
DETAILED STEPS
Configuring the IPsec SA Idle Timer per Crypto Map
This task configures the IPsec SA idle timer for a specified crypto map. The idle timer configuration will be applied to all SAs under the specified crypto map.
Note |
This configuration task was available effective with Cisco IOS Release 12.3(14)T. |
DETAILED STEPS
Configuration Examples for IPsec Security Association Idle Timers
- Configuring the IPsec SA Idle Timer Globally Example
- Configuring the IPsec SA Idle Timer per Crypto Map Example
Configuring the IPsec SA Idle Timer Globally Example
The following example globally configures the IPsec SA idle timer to drop SAs for inactive peers after 600 seconds:
crypto ipsec security-association idle-time 600
Configuring the IPsec SA Idle Timer per Crypto Map Example
The following example configures the IPsec SA idle timer for the crypto map named test to drop SAs for inactive peers after 600 seconds:
crypto map test 1 ipsec-isakmp set security-association idle-time 600
Note |
The above configuration was not available until Cisco IOS Release 12.3(14)T. |
Additional References
Related Documents
MIBs
| MIBs |
MIBs Link |
|---|---|
| None |
To locate and download MIBs for selected platforms, Cisco IOS software releases, and feature sets, use Cisco MIB Locator found at the following URL: |
Technical Assistance
| Description |
Link |
|---|---|
| The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password. |
Feature Information for IPsec Security Association Idle Timers
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
| Table 1 | Feature Information for IPsec Security Association Idle Timers |
| Feature Name |
Releases |
Feature Information |
|---|---|---|
| IPsec Security Association Idle Timers |
12.2(15)T 12.3(14)T |
With the introduction of the IPsec Security Association Idle Timers feature, there is now an idle timer that can be configured to monitor SAs for activity, allowing SAs for idle peers to be deleted and new SAs to be created as required to increase the availability of resources. This feature also improves the scalability of Cisco IOS IPsec deployments. This feature was introduced in Cisco IOS Release 12.2(15)T. In Cisco IOS Release 12.3(14)T, the set security-association idle-time command was added, allowing for the configuration of an IPsec idle timer for a specified crypto map. The following commands were introduced or modified: crypto ipsec security-association idle-time, set security-association idle-time . |
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
Feedback