Subject: [Ipsec] Doubts regarding SA's formed suring IKEv2

From: Rahul Vaidya <[email-masked]>
Date: Fri, 29 Oct 2004 12:08:40 +0530

Hi All,

       I have some doubts regarding SA's formed during IKEv2.

1. In IKE_SA_INIT  phase, is a bi-directional IKE SA formed
(Bidirection meaning same properties for inbound and outbound traffic
at one end)

2.  In IKE_AUTH phases, is a bi-directional  ESP/AH  SA formed  or a
pair of  IPSEC SA's  (different properties for inbound and outbound
traffice at one end) formed? (Considering H1 and H2 as hosts between
which IKE is being negotiated, does it mean that, during IKE_AUTH,
IPSEC SA's are formed simultaneously from H1 to H2 and  also from H2
to H1, assuming H1 is the initiator.)
  
                  i. If a pair of SA's are being formed during
IKE_AUTH, Can they have different "SA algorithms etc" in each
direction. (Like say H1 to H2 I want ESP. And H2 to H1 I want only
authentication, i.e AH.) Is it possible?

                   ii. Also is it possible to do create a
uni-directional IPSec SA in either IKE_AUTH              or
Create_Child SA?

Thanks in advance,

Regards,
Rahul Vaidya.

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec