| IKE SA | 默认常用 86400s，可协商 |
|---|---|
| IPsec SA | 默认常用 3600s，可含流量维度 |
| 不一致 | 按协商或较短方行为执行 |
| 观察 | show crypto ipsec sa 查看剩余生命 |
Cisco 调整
Cisco 调整
crypto ipsec security-association lifetime seconds 3600
crypto isakmp policy 10
lifetime 86400
!
show crypto ipsec sa | include remaining