Hi, The key_do_allocsa_policy searches and deletes the non preferred sas if there are multiple sas that match the search parameters . I see that if there are multiple sas of same parameters established between end points, this end up in deletion of all "outbound sa" but the preferred sa. Since the deletion occurs only on the outbound sa, this ends up in a scenario where the corresponding inbound ipsec sas gets unpaired and not cleaned up particularly when the ike daemon doesnt send a delete notification of sa to the other peer. ( racoon2 ikev1 doesnt seem to do this).
In such a scenario, what should be the proper thing to do?. 1. Make sure that a delete notification is sent by the iked so that the peers can cleanup the unpaired sa. 2. Since ipsec sas are always paired, should we delete the unpaired sa in the kernel at the same time? Thanks Reji _______________________________________________ freebsd-net@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"
