sa soft-duration time-based buffer (IKE peer view)

Function

The sa soft-duration time-based buffer command sets the soft timeout buffer time for an IKE SA.

The undo sa soft-duration time-based buffer command cancels the configuration.

By default, the soft timeout buffer time is not configured for an IKE SA.

Format

sa soft-duration time-based buffer seconds

undo sa soft-duration time-based buffer

Parameters

Parameter	Description	Value
seconds	Specifies the soft timeout buffer time for an IKE SA.	The value is an integer that ranges from 10 to 36000, in seconds.

Views

IKE peer view

Default Level

2: Configuration level

Usage Guidelines

Usage Scenario

Before the IKE SA hard lifetime (hard timeout period) expires, a new IKE SA is negotiated to replace the original IKE SA. The time from the establishment of the original IKE SA till the negotiation of the new IKE SA is the soft lifetime (soft timeout period). The administrator can set the soft timeout buffer time to adjust the IKE SA re-negotiation time.

Table 1 lists the default soft lifetime values.

**Table 1** Soft lifetime values
IKE Protocol Type	Description
IKEv1	90% of the actual hard SA lifetime
IKEv2	85% of the actual hard SA lifetime plus or minus a random value

After the soft timeout buffer time is specified, if the hard lifetime is greater than the soft timeout buffer time by more than 10s, the system uses the soft timeout buffer time subtracted from the hard timeout as the soft lifetime; otherwise, the default soft lifetime is used.

Precautions

During IKEv1 negotiation, the responder cannot initiate IKE SA renegotiation after the IKE SA soft lifetime expires.

During IKEv2 negotiation, the responder runs the ike negotiate compatible command in the IKE peer view. After the IKE SA soft lifetime expires, the responder cannot initiate IKE SA renegotiation.

Example

# Set the soft timeout buffer time for an IKE SA to 600s.

<sysname> system-view
[sysname] ike peer ike_peer
[sysname-ike-peer-ike_peer] sa soft-duration time-based buffer 600