Subject: [IPsec] Query on IKEv2 SA

From: "Raghunandan P (raghup)" <[email-masked]>
Date: Mon, 9 Mar 2009 15:39:14 +0530

Hi,
I had a query related to the IKEv2 SA existance and the method used to
delete it.
 
IKEv2 protocol supports continous channel mode, which implies that once
we delete IKEv2 SA, all the IPSec SAs created using this IKEv2 SA also
get deleted. However, if the last IPSec SA is deleted, the IKEv2 SA is
not deleted. Is this understanding correct?
 
If the above is correct, what is the purpose of having this standalong
IKEv2 SA? Since maintaining the IKEv2 SA consumes resources in the
system, what is the advantage offered by having this standalong IKEv2
SA?
 
If the standalone IKEv2 is indeed brought up, when is this IKEv2 SA
deleted and what is the method used to delete this IKEv2 SA? One example
is a phase 2 proposal mismatch, in which case, we can still bring up the
IKEv2 SA only. How is the IKEv2 SA deleted in this case and in any other
general case?
 
I could not find much information on this in the draft and hence more
clarity would help.
 
Thanks
Raghu

---

From: Yoav Nir <[email-masked]>
Date: Mon, 9 Mar 2009 13:02:22 +0200

Hi Raghu.

You are correct. It is not mandatory to delete an IKE SA without child SAs.

The draft does not specify the complete behavior of all products that implement it. It describes a language (IKE) by which two implementations may "converse"

If is perfectly valid to create an implementation where having a "child-less" IKE SA is not acceptable. Such an implementation would delete the IKE SA if no child SAs are left. It is also perfectly valid not to do so.

For an example, think of the remote access case using EAP for user passwords (or using certificate stored in MS CAPI or Apple Keychain, where you need a password to unlock the cert).  Setting up an IKE SA is not only computationally intensive (Diffie-Hellman), but also intrusive as it requires user interaction.  Suppose we had a child SA used to reach the mail server. Since the mail client only connects once every 10 minutes, the child SA times out and is deleted without a rekey.  If either the client or the gateway now delete the IKE SA, then we will again require user interaction to set up the new IKE SA.  That is not the user experience we want.  Better to keep the IKE SA and have the child SA set up automatically when the need arises.

Hope this helps

Yoav

________________________________
From: [email-masked] [mailto:[email-masked]] On Behalf Of Raghunandan P (raghup)
Sent: Monday, March 09, 2009 12:09 PM
To: [email-masked]
Subject: [IPsec] Query on IKEv2 SA

Hi,
I had a query related to the IKEv2 SA existance and the method used to delete it.

IKEv2 protocol supports continous channel mode, which implies that once we delete IKEv2 SA, all the IPSec SAs created using this IKEv2 SA also get deleted. However, if the last IPSec SA is deleted, the IKEv2 SA is not deleted. Is this understanding correct?

If the above is correct, what is the purpose of having this standalong IKEv2 SA? Since maintaining the IKEv2 SA consumes resources in the system, what is the advantage offered by having this standalong IKEv2 SA?

If the standalone IKEv2 is indeed brought up, when is this IKEv2 SA deleted and what is the method used to delete this IKEv2 SA? One example is a phase 2 proposal mismatch, in which case, we can still bring up the IKEv2 SA only. How is the IKEv2 SA deleted in this case and in any other general case?

I could not find much information on this in the draft and hence more clarity would help.

Thanks
Raghu

Email secured by Check Point

---

From: Tero Kivinen <[email-masked]>
Date: Mon, 9 Mar 2009 15:24:17 +0200

> not deleted. Is this understanding correct?

Yes, that is correct. You can have IKE SA without any Child/IPsec SAs. 

> system, what is the advantage offered by having this standalong IKEv2

Lets say you have situation where you create new Child/IPsec SA for
each TCP connection. With for example web traffic those TCP
connections are quite short lived, and it would be very expensive to
create new IKE SA for each of them, so you want to create them using
same IKE SA. When the last TCP connection goes away (and user is
reading the web page), the IKE SA will still be kept there, and then
when user clicks some link to fetch more stuff from the server, new
TCP connections are created, and those can be created using the
already existing IKE SA.

So in some scenarios it is advantageous to keep the IKEv2 SA up even
after the last Child/IPsec SA disappears. In some scenarios it might
be useful to put some kind of idle timer there, and delete that IKEv2
SA if it stays there for too long (for example more than 10-30
minutes).

> IKEv2 SA only. How is the IKEv2 SA deleted in this case and in any other

IKEv2 SAs are only deleted by two ways:

1) Explicit INFORMATIONAL exchange having delete payload in request
   packet (with Protocol ID 1 for IKE_SA, and empty SPI), and other
   ends response packet (without delete payload, so this response is
   usually just empty packet (i.e only encrypted payload but nothing
   in there).

2) By timeout, i.e. if other end does not send response to the request
   that has been "retransmitted at least a dozen times over a period
   of at least several minutes before giving up on an SA". In that
   case the IKE SA is simply remoeved from memory, without further
   communcations to the other end.

Note, that case 1 applies also to the old IKE SA after IKE SA rekey,
i.e. even that will be deleted by sending delete payload in
INFORMATIONAL exchange. 

> I could not find much information on this in the draft and hence more

Case 1 is explained in section 3.11 of RFC 4306 and section 5.8 of
RFC4718. Case 2 is explained in section 2.4 of RFC 4306.
-- 
[email-masked]