Subject: [Ipsec] How many SPDs ?

From: "mahdavi" <[email-masked]>
Date: Thu, 27 Jan 2005 14:58:34 +0330

Hi experts.

I want to design a high throughput hardware router with IPsec support. I
supposed to support 200K SA connections. 

The question is how many SPD records I have to Support? 200K or less? What is
the criterion?

<-:->

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Surya Batchu <[email-masked]>
Date: Thu, 27 Jan 2005 09:46:55 -0800 (PST)

If you are targeting 100,000 peers, you need to have 200,000 security policies. 
If only ESP with AUTH is required, then  200K SAs are established in steady state.
Due to rekeying because of softlife time, there is a possibility of more than one SA pair
existing with a peer. So, it is better to leave some SA space for this.
 
Surya

mahdavi <[email-masked]> wrote:

Hi experts.

<-:->

---------------------------------
Do you Yahoo!?
 Meet the all-new My Yahoo! – Try it today!

---

From: Stephen Kent <[email-masked]>
Date: Fri, 28 Jan 2005 06:43:20 -0500

At 9:46 AM -0800 1/27/05, Surya Batchu wrote:
>Content-Type: text/html; charset=us-ascii
>X-MIME-Autoconverted: from 8bit to quoted-printable by ietf.org id MAA06079
>
>

Th question was about SPD entries, not SAD entries.  Depoending on 
the form of the SPD entries, one may need very few to support 
creation of 200K SAD entries, or one may need a lot.   For example, 
use of the populate from packet flag enables a single SPD entry to 
yield many SAD entries. Also, a named SPD entry may yield many SAD 
entries.  So, there is no simple formula for how many SPD entries are 
needed to support 200K SAs.

Steve