Re: [IPsec] Another round of IKEv2-bis issues

[David Wierbowski <[e-mail]>]

>I think we need to mandate that logic you explained there to the RFC.
>The text there does that. It says that you need to keep Child SAs and
>IKE SAs connected, and either all of them work, or none of them work
>(or you might also get delete notifications for those which failed,
>provided the IKE SA stays up).
>
>What is not allowed that some of the Child SAs stay up, but the IKE SA
>does not (i.e. no delete notifications). And this from the remote
>point of view, i.e. if you maintain internal bookeeping and destroy
>the Child SA when one security processor fails, that is fine, and from
>the remote point of view all Child SAs and IKE SA got destroyed.

I don't think we need to mandate how a particular situation should be
handled.  That is up to the implementer.  The implementer just needs to
know that there is a rule that states the it is not for some child SAs
stay up when the IKE_SA disappears.  I think the existing text could be
deleted.

Dave Wierbowski


z/OS Comm Server Developer

 Phone:
    Tie line:   620-4055
    External:  607-429-4055