Page MenuHomeVyOS Platform

Unconfigurable IKE and ESP lifetime
Closed, ResolvedPublicBUG


In rewritten IPSec implementation missed `lifetime options for IKE and ESP
From strongswan documentation, it a bit modified and should be:
ipsec.conf (old)
ikelifetime=3h (strongswan default)

connections.<conn>.rekey_time=170m (default: 4h)
connections.<conn>.over_time=10m (default: 10% of rekey_time)
see ExpiryRekey for details

By default, it adds about 10% to rekey_time, so with defined rekey_time=3600s we can see in ISAKMP value 3960

ESP phase2:
ipsec.conf (old)
lifetime=1h (strongswan default)

connections.<conn>.children.<child>.life_time=1h (strongswan default: 110% * rekey_time)
but configuring
connections.<conn>.children.<child>.rekey_time (default: 1h, so setting life_time to 1h without changing this, will disable rekeying)
instead is preferred, see below and ExpiryRekey for details


Difficulty level
Easy (less than an hour)
Why the issue appeared?
Implementation mistake
Is it a breaking change?
Perfectly compatible

Related Objects

Event Timeline

c-po added a subscriber: sdev.
c-po triaged this task as High priority.
c-po changed Difficulty level from Normal (likely a few hours) to Easy (less than an hour).
c-po changed Why the issue appeared? from Will be filled on close to Implementation mistake.
c-po changed Is it a breaking change? from Unspecified (possibly destroys the router) to Perfectly compatible.