Understanding Key Activation

When a member receives a new key from the server, it waits a period of time before using the key for encryption. This period of time is determined by the activation-time-delay configuration statement and whether the key is received through a rekey message sent from the server or as a result of the member reregistering with the server.

If the key is received through a rekey message sent from the server, the member waits 2*(activation-time-delay) seconds before using the key. If the key is received through member reregistration, the member waits the number of seconds specified by the activation-time-delay value.

A member retains the two most recent keys sent from the server for each group SA installed on the member. Both keys can be used for decryption, while the most recent key is used for encryption. The previous key is removed the number of seconds specified by the activation-time-delay value after the new key is activated.

The default for the activation-time-delay configuration statement is 15 seconds. Setting this time period too small can result in a packet being dropped at a remote group member before the new key is installed. Consider the network topology and system transport delays when you change the activation-time-delay value. For unicast transmissions, the system transport delay is proportional to the number of group members.

Related Topics

• Junos OS Feature Support Reference for SRX Series and J Series Devices
• Understanding the GDOI Protocol
• Understanding Group Servers and Members
• Understanding Group Keys
• Understanding Rekey Messages
• Understanding Member Reregistration
• Group VPN Configuration Overview