On Tue, 27 Sep 2005, Agent Smith wrote: > ike_life is set by the keyword ikelifetime which is > phase 1 timeout (maximum supported is 8 hr.) > > ipsec_life is set by keylife keyword and that is phase > 2 timeout. > > phase 2 timeout is typically less then phase 1 > timeout. > > correct? Yes Paul