  <varlistentry>
  <term><emphasis remap='B'>xfrmlifetime</emphasis></term>
<listitem>
<para>The time in seconds until the XFRM acquire state times out. The
default value is 30 seconds.
For auto=ondemand connections and Opportunistic connections an IPsec policy
is installed in the kernel. If an incoming or outgoing packet matches this
policy, a state is created in the kernel and the kernel sends an ACQUIRE
message to the IKE daemon pluto. While this state is in place,
no new acquires will come in for this connection. The default should be
fine for most people.
One use case of shortening these is if opportunistc encryption is used
towards cloud instances that can quickly re-use IP addresses. This value
is only used during the libreswan startup process by the ipsec _stackmanager
helper. See also
<emphasis remap='B'>failureshunt</emphasis> and <emphasis remap='B'>negotiationshunt</emphasis>
</para>
  </listitem>
  </varlistentry>
