Subject: [IPsec] Session resumption vs. failover

From: Paul Hoffman <[email-masked]>
Date: Thu, 14 Aug 2008 09:02:00 -0700

Greetings again. The ipsecme WG charter talks about session 
resumption, but also says that "Failover from one gateway to another, 
mechanisms for detecting when a session should be resumed, and 
specifying communication mechanisms between gateways are beyond the 
scope of this work item". There were questions at the Dublin meeting 
and on this list about what this means.

One expected use case for the session resumption mechanism is to 
allow remote access systems such as laptops to go into hibernation or 
standby mode and later reconnect to the same gateway when they 
awaken. The remote system may have changed locations and/or IP 
addresses. The use of a "session resumption" in this scenario will 
eliminate the need for possibly manual user authentication. Another 
scenario is the remote user's network being powered down and then 
back up later, such as to save energy or due to an extended network 
outage that does not affect the gateway.

Gateway clusters might share resumption information between 
themselves, but the method they use and the information they share 
are explicitly out of scope for the WG. If such gateways do share 
sufficient information (such as a ticket encrypting key) to do 
failover in a secure fashion, they can use the chartered resumption 
mechanism to do so; however, the WG work will not make any effort to 
help this other than to make the ticket extensible.

--Paul Hoffman, Director
--VPN Consortium
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: "Sood, Kapil" <[email-masked]>
Date: Fri, 15 Aug 2008 06:40:48 -0700

Hi Paul,

I concur...The "Session Resumption" use-case for clients going in/out of
hibernate and standby is a perfectly valid, and is one we'd be
interested in contributing.

Best Regards,
 
Kapil.
--------
Kapil Sood
Security Architect
Intel CTG-Comms Labs
971.506.1700

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of Paul Hoffman
Sent: Thursday, August 14, 2008 9:02 AM
To: IPsecme WG
Subject: [IPsec] Session resumption vs. failover

--Paul Hoffman, Director
--VPN Consortium