Subject: Re: [Ipsec] Pre-RFC3706 problems

From: "Scott G. Kelly" <[email-masked]>
Date: Fri, 14 Oct 2005 16:32:39 -0700 (GMT-07:00)

"Back then" I worked on a system that did a couple of things - first, rebooted systems would initiate IKE (sending an initial contact message in the process) if (1) they had outbound traffic requiring protection or (2) they received ESP or IKE from a known peer for which no SAs existed. Another thing we did was send pings through the phase 2 tunnels to detect black holes, tearing down SAs for which there was no other end.

What we were doing was non-standard, and arguably, there were some security issues with the approaches. However, it kept customers a little bit happier. The lack of an interoperable approach ultimately led to RFC3706, but I imagine there are still proprietary solutions out there.

-----Original Message-----
From: Geoffrey Huang <[email-masked]>
Sent: Oct 14, 2005 4:06 PM
To: "James Comen (NC/TNT)" <[email-masked]>
Cc: "[email-masked]'" <[email-masked]>
Subject: Re: [Ipsec] Pre-RFC3706 problems

On Fri, 2005-10-14 at 15:14 -0500, James Comen (NC/TNT) wrote:
> Hello, 
> Prior to RFC3706, was waiting for IKE SA expiration the only way to
> deal with a dead/rebooted IKE peer (assuming different vendors so a
> proprietary solution was not possible).  I know this is mentioned in
> RFC3706 but I was curious to learn if there were no other
> alternatives.
> 

There was the heartbeats draft that Andrew Krywaniuk worked on.  I'm not
sure how many implementations there were, however.  Of course, there was
always Initial Contact, but again, the I don't think that many
implementations did IC properly back then.  (I have to say, however,
that "back then" was before my time.)

> If a remote peer rebooted and was not passive, could it intiate an IKE
> negotiation with initial contact? 

I'm not sure what you mean by "passive," but yes, IC should help the
situation.  This assumes that the peer will reboot, however, or at least
become reachable again.  In some cases, the peer might become
unreachable indefinitely.

> But, if the remote peer was passive or just died without reboot, would
> the local peer truly be limited to waiting till IKE SA expiry?
> 

Yes, unless there was some manual intervention.

-g

> Thank you, 
> Jim Comen
> 
> _______________________________________________
> Ipsec mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/ipsec

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec