Subject: [Ipsec] Address renewal...

From: Stjepan Gros <[email-masked]>
Date: Mon, 25 Sep 2006 18:32:51 +0200

Hi!

We are adding DHCP support to IKEv2 daemon and we have one question
regarding renewal of leased IP addresses. Namely, when lease is about to
expire both initiator and responder know that, either via direct contact
to dhcp server (responder), or via cfg payload (initiator).

Now, there are two possibilities how to react:

1. Responder, without any request from initiator, tries to renew
address. Note that if responder succeeds in renewal (and gets the same
address), then it keeps SA further. Otherwise, if it doesn't succeed or
it got another IP address(es), then it deletes IKE SA.

2. Responder doesn't care and waits for Initiator to request, via CFG
payload, renewal. If initiator doesn't renew address (either doesn't try
or doesn't succeed), then, after some grace period, responder just
deletes IKE SA.

It seems like number 2 is more efficient, as far as resources are
concerned. Also, it seems like variant 1 can be emulated by variant 2
(tell initiator that lease is valid indefinitely, but responder does
renewal automatically).

So, what do you think is the correct behavior?

Thanks,
Stjepan

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: <[email-masked]>
Date: Tue, 26 Sep 2006 11:04:48 +0300

Hi,

In draft-eronen-ipsec-ikev2-clarifications (soon to appear as RFC), 
we recommended not sending INTERNAL_ADDRESS_EXPIRY attributes at all.
This would imply option 1.

(The main reason being that the client shouldn't have to know or
care whether the address pool is managed by the gateway (responder)
itself, or some back-end server on behalf of the gateway. And 
INTERNAL_ADDRESS_EXPIRY is not very useful in case it's managed
by the gateway itself.)

Best regards,
Pasi
 
> -----Original Message-----
> From: ext Stjepan Gros [mailto:[email-masked]] 
> Sent: 25 September, 2006 19:33
> To: [email-masked]
> Cc: [email-masked]
> Subject: [Ipsec] Address renewal...
> 
> Hi!
> 
> regarding renewal of leased IP addresses. Namely, when lease 
> is about to expire both initiator and responder know that, either 
> via direct contact to dhcp server (responder), or via cfg payload 
> (initiator).
> 
> address), then it keeps SA further. Otherwise, if it doesn't 
> succeed or it got another IP address(es), then it deletes IKE SA.
> 
> payload, renewal. If initiator doesn't renew address (either 
> doesn't try or doesn't succeed), then, after some grace 
> period, responder just deletes IKE SA.
>