Subject: [IPsec] IKEv1 delete/notify response question

From: Paul Wouters <[email-masked]>
Date: Mon, 31 Oct 2011 11:52:38 -0400 (EDT)

Hi,

I'm looking at a bug report where openswan sends a Delete/Notify in response to 
a Delete/Notify message. I vaguely remember things got cleared up on this for 
IKEv2, but I cannot find in 2401/2406/etc what the proper response is.

If the peer send us a Notify/Delete, they no longer can receive our Notify/Delete. 
However, without receiving it, they cannot tell we actually deleted the SA.

Should we keep sending Delete/Notify's to Delete messages - even though the 
majority of those cannot be read by the other peer?

If there is no clear RFC guideance, what do other implementations do in this case?

Thanks,

Paul