RE: [FW1] IKE and IPSEC regeneration key period

["Gibson, Brian" <GibsonB@FW1-NOSPAMgruntal.com>]

Is there any particlar reason that you want to shorted the key period?  Are you using Triple DES? If you are then you really don't need to change the keys that often.  The IKE exchange does cause a bit of a performance hit and if your FW mod has  a lot of users you could see some significant performance hits.

-----Original Message-----
From: Arie Gilboa [mailto:arie.gilboa@telrad.co.il]
Sent: Monday, March 19, 2001 3:40 AM
To: 'fw-1-mailinglist@lists.us.checkpoint.com'
Subject: [FW1] IKE and IPSEC regeneration key period

The default values for IKE and IPSEC re-generation key period, in FW1, seem to me too long.

I would like to reduce, IPSEC period to 15 Minutes. Is there any problem with doing it ?.

Any recommendation ?.

 

Thanks,

Arie Gilboa