Subject: [Ipsec] Simple IPSec question

From: [email-masked]
Date: Mon, 28 Feb 2005 19:36:05 -0700

Folks,
     I have just read a tutorial on IPSec, and have a few questions. Hope they are not too trivial.

I have downloaded the following five steps from a site on the internet.
             "How IPSec Works"

1) "Interesting traffic" initiates the IPSec process. Traffic is deemed interesting when the IPSec security policy configured in the IPSec peers starts the IKE process.

2) IKE phase 1. IKE authenticates IPSec peers and negotiates IKE SAs during this phase, setting up a secure channel for negotiating IPSec SAs in phase 2.

3) IKE phase 2. IKE negotiates IPSec SA parameters and sets up matching IPSec SAs in the peers.

4) Data transfer. Data is transferred between IPSec peers based on the IPSec parameters and keys stored in the SA database.

5) IPSec tunnel termination. IPSec SAs terminate through deletion or by timing out.

The question is how often step 2 & 3 take place? My understanding is that only once for the first frame and then a SA remains valid till it times out or deleted, right?

Do we have any performance figure of a system with IPSec enabled? Specially with iSCSI.

Kallol

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec