Subject: [IPsec] How long does an IKEv1 session take to complete?

From: [email-masked]
Date: Tue, 17 Nov 2009 23:31:45 -0700 (GMT-07:00)

Greetings. Is there any data out there that quantifies how long a typical IKEv1 session (main mode and/or aggressive mode) take to complete?

Hyla

---

From: Dan McDonald <[email-masked]>
Date: Wed, 18 Nov 2009 11:27:50 -0500

On Tue, Nov 17, 2009 at 11:31:45PM -0700, [email-masked] wrote:
<SNIP!>

> Greetings. Is there any data out there that quantifies how long a typical
> IKEv1 session (main mode and/or aggressive mode) take to complete?

I don't think anyone's done a thorough survey of implementations or
parameters they use.  If anyone has, or knows of such a survey, they should
really share with this list.

A LOT depends on what you use for your Oakley Group, your authentication
method (and the certificate key size in the case of certificates), and, of
course, the hardware upon which you run it.  There's a lot of combinations
there!

Dan

---

From: Gregory Lebovitz <[email-masked]>
Date: Wed, 18 Nov 2009 10:00:22 -0800

Additionally it will depend on the round trip time across the network
between the two peers.

Vendors who are selling network boxes that can do a large number of
simultaneous IKE negotiations tend to care more about simultaneous IKE SA
negotiations per second than they do the actual negotiation time of any one
single negotiation.

HTH,
Gregory.

On Wed, Nov 18, 2009 at 8:27 AM, Dan McDonald <[email-masked]> wrote:

> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec
>

-- 
----
IETF related email from
Gregory M. Lebovitz
Juniper Networks

---

From: Dan McDonald <[email-masked]>
Date: Wed, 18 Nov 2009 13:02:21 -0500

> Additionally it will depend on the round trip time across the network

Ahh, of course.

> negotiations per second than they do the actual negotiation time of any one

Yes, the throughput vs. latency issues.  A user might care about his/her
latency (0-to-IPsec times), but a server vendor (not just a VPN box, BTW --
imagine the IPsec-protected server) might care a lot more about aggregate
P1s/second.

Dan

---

From: Yoav Nir <[email-masked]>
Date: Thu, 19 Nov 2009 07:49:15 +0200

What Dan and Gregory said.

But assuming an unloaded gateway, with "normal" hardware (Any Intel, AMD or PowerPC processor from the last 10 years or a recent ARM), then even if you use relatively secure parameters (2048-bit DH group, 2048-bit RSA keys) the round trip time is going to dominate. The calculations themselves take less than 20 milliseconds.

So phase 1 should take about 3 round trips.