Subject: RE: [Ipsec] Create_child_SA

From: "Charlie Kaufman" <[email-masked]>
Date: Sat, 25 Sep 2004 19:59:15 -0700

The terminology is a little confusing, but IKEv2 does what you want.

ESP and AH SAs are never bidirectional. IKE SAs are always
bidirectional. Because in the 99.9999% case, people want data to flow in
both directions, IKEv2 always creates ESP and AH SAs in pairs - one in
each direction and both have the same traffic selectors. It also
requires that they be deleted together. So phase I of IKEv2 always
negotiates three SAs - a bidirectional IKE SA and a pair of SAs for
data. (Note: IKEv2 also no longer uses the phase I / phase II
terminology, but I know what you mean).

In practice, this is also how IKEv1 is always used, but the protocol
allows the flexibility to do otherwise.

	--Charlie

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of rajavel samy
Sent: Tuesday, September 21, 2004 3:20 AM
To: [email-masked]
Subject: [Ipsec] Create_child_SA

Hi,
I like to get clarified regarding the first child SA
creation and CREATE_CHILD_SA. 

1. Is it possible to create bidirectional SAs (example
tunneling all inbound and outbound traffice between
initiator and responder)within the phase I of IKEv2
procedure.

2. Also is it possible to create bidirectional SAs
with a single exchange of CREATE_CHILD_SA messages.

Thanks 
Rajvel.

________________________________________________________________________
Yahoo! India Matrimony: Find your life partner online
Go to: http://yahoo.shaadi.com/india-matrimony

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec