This is the default lifetime in seconds assigned to an IPsec security association as a global policy, per its description, unless a specific cryptomap definition overrides it. It sets the baseline rekey interval for Phase-2 SAs across the device, so an admin changing this value affects every cryptomap that doesn't have its own explicit lifetime set. A global value of 3600 with one cryptomap overriding it to 1800 means that one cryptomap's SAs rekey twice as often as everything else on the router.