Once can not only have the SA change after xx seconds, but also after yy bytes. This is supported by StrongSwan but missing on the CLI.
lifebytes = <number> the number of bytes transmitted over an IPsec SA before it expires. Not supported for IKEv1 connections prior to 5.0.0. lifepackets = <number> the number of packets transmitted over an IPsec SA before it expires. Not supported for IKEv1 connections prior to 5.0.0.
https://wiki.strongswan.org/projects/strongswan/wiki/ExpiryRekey