Subject: RE: [Ipsec] Delete payloads in IKEv2

From: [email-masked]
Date: Tue, 19 Oct 2004 15:56:40 +0300

[email-masked] writes:
> 
> Hi all,
> 
> I would like to know whether delete payloads can come in 
> any exchange messages or not.
> 
> If delete payloads received in any message other than 
> informational exchange,  Should we ignore the payload 
> or should we drop the message???

Delete payloads can be sent only in informational exchange.

> Can the informational exchange request/response contain the 
> multiple delete payloads??

Yes (see e.g. Section 3.11).

> Suppose, the peer did not receive a reply for a keep-alive, 
> then can the peer generate an informational exchange with 
> multiple delete payloads (corresponding to IKE SA and CHILD SAs)?? 
> In this case we can avoid sending multiple informational 
> exchange messages.

If by keep-alive you mean an empty informational exchange, the 
answer is no: after the peer has given up on retransmissions, 
it just closes the SAs without sending anything more.

(And if you meant NAT keepalives for UDP encapsulation,
the other end does not send replies to them.)

Best regards,
Pasi

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec