H3C S6550X-HI Series Command Reference Manual page 2285

Default
The time-based and traffic-based IPsec SA soft lifetime buffers are not configured.
Views
IPsec policy view
IPsec profile view
Predefined user roles
network-admin
Parameters
time-based seconds
value range is 20 to 201600.
traffic-based kilobytes
The value range is 1000 to 4294901760.
Usage guidelines
This command takes effect only when IKEv1 is used.
The IPsec SA soft lifetime buffers are used to determine the IPsec SA soft lifetimes.
If no IPsec SA soft lifetime buffers are configured, the system calculates a default time-based and a
default traffic-based IPsec SA soft lifetime.
If IPsec SA soft lifetime buffers are configured, the system calculates IPsec SA soft lifetimes as
follows:
•
Time-based IPsec SA soft lifetime = time-based IPsec SA lifetime – time-based IPsec SA soft
lifetime buffer.
If the calculated time-based IPsec SA soft lifetime is shorter than or equal to 20 seconds, the
system uses the default time-based IPsec SA soft lifetime.
•
Traffic-based IPsec SA soft lifetime = traffic-based IPsec SA lifetime – traffic-based IPsec SA
soft lifetime buffer.
If the calculated traffic-based IPsec SA soft lifetime is smaller than or equal to 1000 Kilobytes,
the system uses the default traffic-based IPsec SA soft lifetime.
Examples
# Set the time-based IPsec SA soft lifetime buffer to 600 seconds in IPsec policy example 1.
<Sysname> system-view
[Sysname] ipsec policy example 1 isakmp
[Sysname-ipsec-policy-isakmp-example-1] sa soft-duration buffer time-based 600
# Set the traffic-based IPsec SA soft lifetime buffer to 10000 Kilobytes in IPsec policy example 1.
<Sysname> system-view
[Sysname] ipsec policy example 1 isakmp
[Sysname-ipsec-policy-isakmp-example-1] sa soft-duration buffer traffic-based 10000
Related commands
ipsec sa global-soft-duration buffer
sa spi
Use
sa spi
Use
undo sa spi
: Specifies the time-based IPsec SA soft lifetime buffer in seconds. The
: Specifies the traffic-based IPsec SA soft lifetime buffer in Kilobytes.
to configure an SPI for IPsec SAs.
to remove the SPI.
60