[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Heartbeats draft



On Sat, 1 Apr 2000, sankarramamoorthi wrote:
> The sequence is as follows
> 
>                   <----- ipsec packet
>        No matching SA
>        parties out of sync
> 
>            ------>  invalid spi
>                     + original 8 bytes of packet
>                     causing this error
>                     The error notification message
>                     is sent in the clear.
>                                                 recover spi from
>                                                 error notification
>                                                 packet. Find sa
>                                                 corresponding to spi,
>                                                 protcol and peer
>                                                 address.
>                                                 If sa not found
>                                                 drop notification
>                                                 message and return.
>                    <------ echo on ipsec SA
>                                                 If echo reply was
>                                                 not received even after
>                                                 a few retries, the
>                                                 error notification is
>                                                 genuine - clean up the
>                                                 stale ipsec SA
>                     ------> echo reply on ipsec SA
>                                                 echo reply successfully
>                                                 received - therefore
>                                                 the ipsec sa is
>                                                 active. Ignore the
>                                                 error notification and
>                                                 return.
> 

This sort of scheme has already been proposed and rejected, since echo
requests may or may not be covered by the classification of the tunnel. This
is not a good scheme.

Replace 'echo on ipsec SA' with some sort of phase 1 keepalive request and
reply (not timed, but, as you proposed above, event driven when needed), and
I could agree, but not if done over phase 2 (for more than just the reason
given above; check the archives).

I'm working on another similar proposal/idea. Once I have some things worked
out someone will post something to the list.

jan
 --
Jan Vilhuber                                            vilhuber@cisco.com
Cisco Systems, San Jose                                     (408) 527-0847