RE: Zero Address Set

hi mohan, 

please see my comment below; 

> Bill,
> 
> > > i thought about the functionality of the "zero address set". one 
> > > important question is: what is this functionality good for?
> >
> > temporary tunnel suspension when the endpoint knows it will 
> be unreachable  for a while.
> >
> Ok. I can see some use for it. But is zero address set alone 
> sufficient or you also need to tell the other end how long 
> you are not reachable ?  Your peer may not want to keep the 
> inactive SAs open for a long time. If you don't specify the 
> time, your peer will delete it anyway after some time. Even 
> if you specify the time, your peer will delete it anyway 
> based on its local configuration (assuming we are not 
> negotiating it). If you don't know how long the SAs will be 
> kept around by your peer, would it still be useful ?

it seems that you would like to add a lifetime parameter to the ike sa (and
additionally suspend the dead peer detection for the indicated amount of
time). 

ciao
hannes


> 
> -mohan
> 
> 
> 
> > > i see this issue from a different point of view.
> > > we have a dead peer detection to provide a mechanism to 
> delete the 
> > > ike sa (and ipsec sas) if the other does not respond anymore.
> >
> > well, let's distinguish two cases:
> >  1) we haven't heard from the peer in a while.
> >  2) the peer has crashed and forgot about the connection
> >
> > For some applications, tearing down state because of (1) 
> may rightly 
> > viewed  as a bug, not a feature -- but you may want fast
> recovery from (2) without
> > tearing down connections merely because of inactivity.
> >
> > > if a laptop has establish an ike sa with a gateway, uses 
> dead peer 
> > > detection and goes into the suspend mode then (even after a short 
> > > amount of time) the ike sa will be gone.
> > >
> > > the 'zero address set' functionality could possibly be seen as 
> > > temporarily suspending the dead peer protection on a 
> specific address (or path).
> >
> > Sorta.
> >
> >
> >
> > - Bill
> >
> >
> > _______________________________________________
> > Mobike mailing list
> > [email protected]
> > https://www.machshav.com/mailman/listinfo.cgi/mobike
>