Subject: [IPsec] ikev2bis issue #181: Section 2.4 unclear on Child SA failing

From: Paul Hoffman <[email-masked]>
Date: Tue, 30 Mar 2010 16:59:18 -0700

Section 2.4 says "If Child SAs can fail independently from one another without the associated IKE SA being able to send a delete message, then they MUST be negotiated by separate IKE SAs". It is not clear what this means. Does it apply to implementations? If so, how can an implementation know whether or not the first clause is true?

I propose removing the sentence, or greatly clarifying it.