Subject: [Ipsec] Pre-RFC3706 problems

From: "James Comen (NC/TNT)" <[email-masked]>
Date: Fri, 14 Oct 2005 15:14:37 -0500

Hello,
Prior to RFC3706, was waiting for IKE SA expiration the only way to deal with a dead/rebooted IKE peer (assuming different vendors so a proprietary solution was not possible).  I know this is mentioned in RFC3706 but I was curious to learn if there were no other alternatives.
If a remote peer rebooted and was not passive, could it intiate an IKE negotiation with initial contact?
But, if the remote peer was passive or just died without reboot, would the local peer truly be limited to waiting till IKE SA expiry?

Thank you,
Jim Comen

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Geoffrey Huang <[email-masked]>
Date: Fri, 14 Oct 2005 16:06:24 -0700

On Fri, 2005-10-14 at 15:14 -0500, James Comen (NC/TNT) wrote:
> Hello, 
> Prior to RFC3706, was waiting for IKE SA expiration the only way to
> deal with a dead/rebooted IKE peer (assuming different vendors so a
> proprietary solution was not possible).  I know this is mentioned in
> RFC3706 but I was curious to learn if there were no other
> alternatives.
> 

There was the heartbeats draft that Andrew Krywaniuk worked on.  I'm not
sure how many implementations there were, however.  Of course, there was
always Initial Contact, but again, the I don't think that many
implementations did IC properly back then.  (I have to say, however,
that "back then" was before my time.)

> negotiation with initial contact? 

I'm not sure what you mean by "passive," but yes, IC should help the
situation.  This assumes that the peer will reboot, however, or at least
become reachable again.  In some cases, the peer might become
unreachable indefinitely.

> But, if the remote peer was passive or just died without reboot, would
> the local peer truly be limited to waiting till IKE SA expiry?
> 

Yes, unless there was some manual intervention.

-g