Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do you advise changing an IPSec L2L VPN pre-shared key with respect to minimizing downtime? Is there any magic formula for this, or best practice, or do you just kind of try to change it on both ends as closely as possible?

share|improve this question

You didn't mention the implementation you're using, so I can't get too specific. But, the PSK is only used for initial authentication and session key management. After that, it's never used again (except reconnecting, which is really just starting a new session). Some implementations allow you to change the PSK without restarting the daemon, others don't.

If you have to change it on some sort of regular basis, you probably shouldn't be using PSK anyway; you should be using certificates.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.