282
To apply another IPsec profile to the tunnel interface, remove the original application first.
An IPsec profile cannot be applied to the DVPN tunnel interface and the IPsec tunnel interface
simultaneously.
Examples
# Apply IPsec profile
vtiprofile
to the IPsec tunnel interface.
<Sysname> system-view
[Sysname] interface tunnel 0
[Sysname-Tunnel0] tunnel-protocol ipsec ipv4
[Sysname-Tunnel0] ipsec profile vtiprofile
# Apply IPsec profile
dvpnprofile
to the DVPN tunnel interface.
<Sysname> system-view
[Sysname] interface tunnel 1
[Sysname-Tunnel1] tunnel-protocol dvpn udp
[Sysname-Tunnel1] ipsec profile dvpnprofile
Related commands
•
ipsec profile (system view)
•
interface
tunnel
(
Layer 3—IP Services Command Reference
).
ipsec sa global-duration
Use
ipsec
sa
global-duration
to configure the global SA lifetime.
Use
undo ipsec
sa
global-duration
to restore the default.
Syntax
ipsec
sa
global-duration
{
time-based
seconds
|
traffic-based
kilobytes
}
undo
ipsec
sa
global-duration
{
time-based
|
traffic-based
}
Default
The time-based global SA lifetime is 3600 seconds, and the traffic-based global SA lifetime is
1843200 kilobytes.
Views
System view
Default command level
2: System level
Parameters
seconds
: Specifies the time-based global SA lifetime in seconds, in the range of 180 to 604800.
kilobytes
: Specifies the traffic-based global SA lifetime in kilobytes, in the range 2560 to
4294967295.
Usage guidelines
When negotiating to set up an SA, IKE prefers the lifetime of the IPsec policy or IPsec profile that it
uses. If the IPsec policy is not configured with its own lifetime, IKE uses the global SA lifetime.
When negotiating to set up an SA, IKE prefers the shorter one of the local lifetime and that proposed
by the remote.
You can configure both a time-based and a traffic-based global SA lifetime. An SA is aged out when
it has existed for the specified time period or has processed the specified volume of traffic.
