Configuring SSH session rekey interval by volume and time

SSH servers can trigger rekeying once a certain time interval is reached or data traffic reaches a specified volume. During rekeying, a set of key exchange messages are transferred between the SSH client and the server, changing the key used for the session security.

Rekeying by volume

In Common Criteria mode, the rekey-volume option cannot exceed a value equal to 1024 MB. The default value is 1024 MB.

The range of the rekey volume configured using the ssh-server command is 50 to 1024 MB.

device(config)# ip ssh server rekey-volume ?
Possible completions:
  <DECIMAL>   <50-1024> Megabytes"

Rekeying by time

The time limit must be set to a value for SSH rekey that is less than 60 minutes to be compliant with Common Criteria. Values of 3600 seconds or higher must not be used. The following command can be used to specify the time.

device(config)# ip ssh server rekey-interval ?
Possible completions:
  <DECIMAL>   <900-3600> Seconds

Login inactivity timeout values

To set the value on Console

device(config)#console timeout ?
  DECIMAL   <0..240> In minutes, 0 never timeout 

To configure the idle timeout for SSH

This is the idle timeout of SSH session. The session will disconnect if there is inactivity in the session for the specified period.

device(config)#ip ssh idle-time ?
  DECIMAL   <0-240> minutes, 0 never timeout