283
The SA lifetime applies to only IKE negotiated SAs. It is not effective on manually configured SAs.
Examples
# Set the time-based global SA lifetime to 7200 seconds (2 hours).
<Sysname> system-view
[Sysname] ipsec sa global-duration time-based 7200
# Set the traffic-based global SA lifetime to 10240 kilobytes (10 Mbytes).
[Sysname] ipsec sa global-duration traffic-based 10240
Related commands
•
sa
duration
•
display
ipsec
sa
duration
ipsec transform-set
Use
ipsec
transform-set
to create an IPsec transform set and enter IPsec transform set view.
Use
undo
ipsec
transform-set
to delete an IPsec transform set.
Syntax
ipsec
transform-set
transform-set-name
undo ipsec transform-set
transform-set-name
Default
No IPsec transform set exists.
Views
System view
Default command level
2: System level
Parameters
transform-set-name
: Specifies the name of an IPsec transform set, a case-insensitive string of 1 to
32 characters.
Examples
# Create an IPsec transform set named
tran1
and enter its view.
<Sysname> system-view
[Sysname] ipsec transform-set tran1
[Sysname-ipsec-transform-set-tran1]
Related commands
display ipsec transform-set
pfs
Use
pfs
to enable and configure the perfect forward secrecy (PFS) feature so that the system uses
the feature when employing the IPsec policy or IPsec profile to initiate a negotiation.
Use
undo pfs
to remove the configuration.
Syntax
pfs
{
dh-group1
|
dh-group2
|
dh-group5
|
dh-group14
}
