Which value of the IPsec rekey timer must be set by the engineer for an OMP graceful restart value set for 24 hours?

6 hours is too short, potentially causing excessive rekeying overhead and not optimizing for the graceful restart window.

Cisco SD-WAN best practices recommend setting the IPsec rekey timer to half the OMP graceful restart interval. For a 24-hour OMP graceful restart, an IPsec rekey timer of 12 hours ensures that IPsec security associations are refreshed multiple times, preventing data plane disruptions before the OMP control plane fully recovers.

36 hours is too long; if the rekey interval exceeds the OMP graceful restart timer, IPsec tunnels could expire during the graceful restart period, leading to traffic disruption.

48 hours is also too long, exceeding the OMP graceful restart timer and risking data plane interruption while the control plane is recovering.