Subject: [Ipsec] IKE query

From: [email-masked]
Date: Fri, 24 Sep 2004 16:34:49 -0500

Hello,

Section 9 of  RFC 2409 (IKE), provides implementation hints . I have a query related
to the following excerpt from the same section:

   An implementation may wish to negotiate a range of SAs when
   performing Quick Mode.  By doing this they can speed up the "re-
   keying". Quick Mode defines how KEYMAT is defined for a range of SAs.
   When one peer feels it is time to change SAs they simply use the next
   one within the stated range. A range of SAs can be established by
   negotiating multiple SAs (identical attributes, different SPIs) with
   one Quick Mode.

 My question is : can those multiple SAs be used simultaneously to achieve
load balancing , or do they have to be used one after the other.

Thank you,
Madhvi

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Francis Dupont <[email-masked]>
Date: Sun, 26 Sep 2004 10:17:17 +0200

In your previous mail you wrote:

=> I believe this is as you'd like but please note the load will be
balanced only with some kind of handware support (parallel crypto
accelerators).

Regards

[email-masked]

---

From: Stephen Kent <[email-masked]>
Date: Mon, 27 Sep 2004 09:45:45 -0400

>load balancing , or do they have to be used one after the other.

In the new version of 2401 we make explicit provision for multiple 
SAs that might be used for various QoS purposes.  It is not clear 
that implementations conforming to the original 2401 spec will always 
be able to do this.

Steve