Subject: [Ipsec] Ipsec dynamic DNS and peer reset

From: "Batta, Anurag" <[email-masked]>
Date: Mon, 18 Jul 2005 08:59:14 -0500

What should happen if Ipsec peers are dynamically assigned IP addresses
and one of the peers go down and comes up with a different IP. In the
configuration, DNS names are configured rather than ip address.

Thanks.

This e-mail may contain confidential or privileged information.  If you think you have received this e-mail in error, please advise the sender by reply e-mail and then delete this e-mail immediately.

Thank you.  U. S. Robotics

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Stephen Kent <[email-masked]>
Date: Mon, 18 Jul 2005 16:07:18 -0400

>configuration, DNS names are configured rather than ip address.

If the IPsec implementation was part of the system that crashed, then 
the SA state would be lost anyway and that would require re-creation 
of previously extant SAs, e.g., to put new keys in place.

If the SPD entry that authorized creation of the SA was name-based, 
not address based, as I think you suggest above, then traffic from 
the peer whose address changed will trigger creation of a new SA to 
replace the old one that was rendered unusable by the address change.

Steve