Subject: [Ipsec] query regarding deletion of IKEv2 session

From: Jyothi <[email-masked]>
Date: Wed, 29 Sep 2004 09:05:19 +0530

Hi all,

I have query regarding the deletion of IKE SA in following case:

Responder received AUTH response consisting of AUTH, SA2,TS,etc payloads.

Responder verified the AUTH and it is successful.

If the responder does not have matching SPD policy either non-matching 
selectors or non-matching proposals. Responder sends the corresponding 
informational exchange.

In this case, do we delete the IKEv2 SA??
I think we should not delete IKE SA. Because AUTH verification is succeeded.

When the administrator changes the SPD policy, then we can start CHILD_SA 
exchange to negotiate IPSEC  proposals.

But, CHILD_SA exchange is optional.

In case if we delete IKE SA, does the responder sends the delete payload 
for IKE SA?? Because AUTH exchange is not complete but AUTH verification is 
succeeded.

Thanks in advance
Jyothi

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: "Srinivasa Rao Addepalli" <[email-masked]>
Date: Wed, 29 Sep 2004 09:46:42 -0700

> In this case, do we delete the IKEv2 SA??

SRINI> I would think so.  If the responder is not returning response to AUTH exchage,
initiator would anyway will not complete the transaction and it fails. 
> I think we should not delete IKE SA. Because AUTH verification is succeeded.
SRINI> But, note that the responder is not returning its authentication credentials. So
there is no need for keeping the IKE SA on responder side.
> But, CHILD_SA exchange is optional.

SRINI> That is true. IKEs with minimal capabilities does not have to support
Child SA.
> for IKE SA?? Because AUTH exchange is not complete but AUTH verification is 

SRINI> It is not needed. IKE SA would not have been matured on Initiator side and
initiator would delete it, if there is no successful AUTH exchange response is received.
> Jyothi

Intoto Inc.
www.intoto.com