Frequently Asked Questions

The main reason why the lifetime of IPSec tunnels is limited is security. The longer a tunnel is alive, the more time an attacker has for an attack and the more data is encrypted with the same session key, which reduces the effort for attackers to find the key. The IKE Phase 1 tunnel is only used to ensure a secure connection between VPN client and VPN gateway, comparable to a TLS connection (i.e. HTTPS instead of HTTP). Only IKE messages are exchanged via the Phase 1 tunnel, which are used to keep the Phase 1 connection alive and to negotiate Phase 2 tunnels if necessary. The Phase 1 tunnel has no influence on the VPN speed, only on the initial connection setup, so there is never any reason why you should not always work with the strongest protection in Phase 1, that both sides can support. Since very little data is ever sent through the Phase 1 tunnel, there is no reason not to choose a very long lifetime. The Phase 2 tunnels are used to encrypt the actual data traffic, so the settings here directly influence the overhead, latency and speed of the VPN connection and must be weighed against the security. Also, large amounts of data are encrypted via the Phase 2 tunnels, so you should not set their lifetime too high. If possible, it is always recommended to use Perfect Forward Secrecy (PFS) in Phase 2, which slows down the Phase 2 connection setup a bit, but completely decouples Phase 2 cryptographically from Phase 1, since an independent session key is negotiated and not derived from the session key of Phase 1. The lifetimes of the two phases are basically independent of each other. A Phase 2 tunnel may continue to exist, even if the Phase 1 tunnel over that it was negotiated no longer exists. Thus, Phase 1 may have a shorter lifetime than Phase 2. VPN Tracker always negotiates new tunnels in time before the lifetime expires, so that the connection is normally never interrupted. With Phase 2, the tunnels are seamlessly connected, meaning that not a single data packet is lost during the exchange. This is why even with a very short lifetime of just a few minutes, the impression of an uninterrupted connection is created. Frequent changes of Phase 2 tunnels only lead to a little more data traffic and a little more computing work on both sides of the connection.

Important Notes

The lifetime of the tunnels is explicitly not negotiated. The standard allows that a tunnel has different lifetimes on both sides of the connection. The side, where the lifetime expires first, determines the further procedure. Only if VPN Tracker is that side, it can determine what happens next, otherwise VPN Tracker can only react passively. The latter will always result in a short interruption or even a complete loss of the connection in case of Phase 1. For Phase 2, it depends on whether the other side wants to actively negotiate new Phase 2 tunnels or only deletes the existing ones; the latter also leads to a short-term connection loss. It's always best to set VPN Tracker to the same lifetime as the other side, because VPN Tracker will always try to intervene in time to avoid a connection loss. Since there are also IKE/IPSec implementations that delete all Phase 2 tunnels as soon as the corresponding Phase 1 tunnel is deleted, it's always a good idea to select Phase 1 on devices to match the maximum VPN session time expected.