Why do IPSec VPN Phases have a lifetime?

Question

I was working on a bug with our VPN, and read about VPN Phases 1 and 2, each of which have a lifetime in seconds. I was investigating to validate if these had anything to do with the bug we had and apparently not, however I'm still curious has to why do these settings exist at all, what's the purpose of these "lifetime" settings for each phases, what if there was no lifetime, or years instead of the default 1 and 8 hours?

I did research the matter of course, but every search result about the phases lifetime has to do with how long they should be, and that the first phase should be smaller than the second phase. No one explains their purpose.

Answer 1

This is the Security Association (SA) lifetime, and the purpose of it is explained e.g. in RFC 7296, 2.8 on rekeying IKEv2:

IKE, ESP, and AH Security Associations use secret keys that should be used only for a limited amount of time and to protect a limited amount of data. This limits the lifetime of the entire Security Association.

If we used the same keys forever, any compromise of the keys would compromise all the data ever encrypted in this tunnel. The SA lifetime puts limits to the time window. IKEv2 also improves this compared to IKEv1:

A difference between IKEv1 and IKEv2 is that in IKEv1 SA lifetimes were negotiated. In IKEv2, each end of the SA is responsible for enforcing its own lifetime policy on the SA and rekeying the SA when necessary. If the two ends have different lifetime policies, the end with the shorter lifetime will end up always being the one to request the rekeying.