Re: [IPsec] I-D ACTION:draft-ietf-ipsecme-ikev2bis-10.txt

[Tero Kivinen <[e-mail]>]

V Jyothi-B22245 writes:
> Hi,
> 
> In section 2.9.  Traffic Selector Negotiation,
> 
> The SINGLE_PAIR_REQUIRED error indicates that a CREATE_CHILD_SA
>    request is unacceptable because its sender is only willing to accept
>    traffic selectors specifying a single pair of addresses.  The
>    requestor is expected to respond by requesting an SA for only the
>    specific traffic it is trying to forward.
> 
> Above paragraph gives the clarity of what action to take when
> SINGLE_PAIR_REQUIRED notify type received in case of CREATE_CHILD_SA
> exchanges.
> 
> Suppose if the SINGLE_PAIR_REQUIRED notify type is received in AUTH
> response, how initiator should act upon it?
> Can initiator resend AUTH request with different TSi and TSr payloads or
> it should establish IKE SA and then start CREATE_CHILD_SA exchange?

It will establish IKE SA even when the Child SA creation failed.

What it does next depends on the implementation. Normal implementation
will simply do CREATE_CHILD_SA with better traffic selectors, and
create Child SA that way. Some implementation might simply mark the
specific rule so that it requires exact traffic selectors, and wait
for next packet hitting that rule before starting CREATE_CHILD_SA
(this is needed if the first Child SA creation in the IKE_AUTH was
done because of auto-start rule, i.e. there is no traffic yet, thus
the initiator does not know the exact traffic selectors).
-- 
[e-mail]