Re: Life and death of IKE SAs and IPSEC SAs

[Daniel Harkins <[e-mail]>]

  Slava,

  The only time I could see this being done is if the ISAKMP SA is being 
deleted because a CRL or a cert expired and you needed to re-authenticate 
the peer. Generally, the ISAKMP SA will die because you don't want to 
derive any more IPSec keys from SKEYID_D. In that case it doesn't make 
any sense to kill all existing IPSec SAs that were derived from the ISAKMP 
SA. If the IPSec SAs have PFS it makes even less sense.

  Actually, if one was to delete the IPSec SAs when the ISAKMP SA expires
it would be impossible to assure PFS for both identities and keys since,
in that case, the ISAKMP SA is supposed to expire immediately upon creation
of the IPSec SAs. Deleteing the just-established IPSec SAs would not be
right.

  Deleting the IPSec SAs when the ISKAMP SA expires would also cause
unnecessary interruptions in the transmission since there is no guarantee
that the expiry timers of the two types of SAs are in sync (i.e. that
they will expire at the same time). If the ISAKMP SA expired first there
would be an ugly hiccup in the transmission while new SAs are being
established. Allowing these "orphaned" IPSec SAs to exist will allow
a new ISAKMP SA and replacement IPSec SAs to be established in the back-
ground (when those "orphaned" SAs time out on their own) and ensure a 
smooth transition of SAs and uninterupted service.

  Dan.

> There is an important  issue which not covered by any draft standards
> and a subject of the debate between IKE implementors, and that is:
> 
> Should or shouldn't we delete IPSEC SAs when "umbrella" IKE SA is
> deleted?
> The deletion of IKE SA may occur when:
> 1) It expires on the local host
> 2) It expires on the remote host which sends re-negotiation proposal to
> my local host
> 3) The remote host notifies local host to delete it for whatever reason
> 4) Local host decides to delete it for whatever reason,
> 5) etc.
> 
> Is this behaviour described anywhere in drafts? Is it a matter of local
> policy? (and if it is - could it create interoperabilty problems?)