Re: [IPsec] Fwd: I-D Action: draft-nir-ipsecme-cafr-00.txt

Hi Yoav,

isn't it better to do Child SAs movement in a separate Informational 
Exchange,
rather than in IKE_AUTH?

Pros:
1. No race conditions
2. No additional complication to already over-complicated IKE_AUTH
3. More generic solution, so can be used in other situations,
    for example in case IKA SA is cloned 
(draft-mglt-ipsecme-keep-old-ike-sa).

Contras:
1. Extra round trip.

Regards,
Valery Smyslov.

> Hi all
>
> For a long time I've felt that re-authentication in IKEv2 has some harsh 
> side effects in both uninterrupted IPsec and in continuation of the 
> internal IP address assignment.
>
> This draft attempts  to solve these issues.
>
> Comments are welcome, and I will be glad if the WG agrees to discuss and 
> adopt this.
>
> Thanks
>
> Yoav
>
>> A New Internet-Draft is available from the on-line Internet-Drafts 
>> directories.
>>
>>
>> Title           : Adopting Child SAs Following Re-Authentication in IKEv2
>> Author(s)       : Yoav Nir
>> Filename        : draft-nir-ipsecme-cafr-00.txt
>> Pages           : 8
>> Date            : 2013-08-12
>>
>> Abstract:
>>   This document describes an extension to the IKEv2 protocol whereby
>>   Child SAs are moved to the new IKE SA following re-authentication.
>>   This allows for a smoother transition with no loss of connectivity.
>>
>>
>> The IETF datatracker status page for this draft is:
>> https://datatracker.ietf.org/doc/draft-nir-ipsecme-cafr
>>
>> There's also a htmlized version available at:
>> http://tools.ietf.org/html/draft-nir-ipsecme-cafr-00
>>
>>
>> Please note that it may take a couple of minutes from the time of 
>> submission
>> until the htmlized version and diff are available at tools.ietf.org.
>>
>> Internet-Drafts are also available by anonymous FTP at:
>> ftp://ftp.ietf.org/internet-drafts/
>
> _______________________________________________
> IPsec mailing list
> IPsec@ietf.org
> https://www.ietf.org/mailman/listinfo/ipsec 