Subject: [IPsec] IPsec child SAs and draft-ietf-ipsecme-ikev2-resumption-00

From: Tero Kivinen <[email-masked]>
Date: Tue, 18 Nov 2008 22:23:39 +0200

The current document does not say what happens to the old IPsec child
SAs that might still be there for the old IKE SA. I.e. if the IKE SA i
still valid in the server when client does IKE_SESSION_RESUME the
draft says the old IKE SA is deleted without sending delete
notification. So I assume no old IPsec child SAs are valid on the
responder end regardless whether the old IKE SA was valid or not.

I think we also need text explictly mentioning this, i.e. saying that
as IKE_SESSION_RESUME is started only AFTER the IKE SA has already
been destroyed because of the timeouts, all the IPsec child SAs are
already deleted before IKE_SESSION_RESUME is started, which means all
IPsec child SAs needs to be recreated for the new IKE SA (i.e. first
IPsec child SA can be done inside the IKE_SESSION_RESUME, rest are
created with separete CREATE_CHILD_SA exchanges in the new IKE SA).
-- 
[email-masked]
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec