Subject: [Ipsec] re-authentication in IKEv2

From: Thomas Gschwendtner <[email-masked]>
Date: Mon, 23 May 2005 08:52:57 -0400

Once an IKEv2 SA got established and is up for a while, can the 
initiator start another  AUTH exchange on that SA (e.g. because the used 
EAP method requires frequent re-authentication)? If yes, could you 
please point me to the section of the IKEv2 draft that says so?

Thanks,

Thomas

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: [email-masked]
Date: Mon, 23 May 2005 17:13:55 +0300

Thomas Gschwendtner writes:
> initiator start another  AUTH exchange on that SA (e.g. 
> because the used EAP method requires frequent re-authentication)? 
> If yes, could you please point me to the section of the IKEv2 draft 
> that says so?

There's no way to do reauthentication within a single IKE_SA;
if the initiator wants to reauthenticate, it just creates a 
new IKE_SA (the same way as the original one) and deletes the 
old one. 

Best regards,
Pasi