Hi Yoav, Mostly the Initiator will decide that it wants to bring UP only IKE SA without child SA. But currently there is no notify/VID from Initiator to Responder to indicate that initiator wants to bring only IKE SA. Even if responder does not supports "childless IKE_AUTH", it will process IKE_SA_INIT, involding CPU intensive D-H calculations, and send IKE_SA_INIT response without "childless VID" payload.
By introducing a notify/VID payload from Initiator that it wants to bring UP only IKE SA without child SA wil ease the processing ar Responder side. If responder does not support "childless IKE_AUTH", it can send INVALID_SYNTAX. Then, Initiator will wait for "Child SA" info to be available to bring UP both IKE and child SA, normally as mentioned in RFC 4306. Thanks, Raj On Thu, Jul 2, 2009 at 1:42 AM, Yoav Nir <y...@checkpoint.com> wrote: > Hi all. > > This is the fourth iteration of this draft. New in this iteration > - Another co-author > - Changed the name, so that this item is considered in the rechartering > discussion > - Fixed some notation and some discussion based on comments from the list > > Yoav > ________________________________________ > From: i-d-announce-boun...@ietf.org [i-d-announce-boun...@ietf.org] On > Behalf Of internet-dra...@ietf.org [internet-dra...@ietf.org] > Sent: Wednesday, July 01, 2009 12:15 > To: i-d-annou...@ietf.org > Subject: I-D Action:draft-nir-ipsecme-childless-00.txt > > A New Internet-Draft is available from the on-line Internet-Drafts > directories. > > Title : A Childless Initiation of the IKE SA > Author(s) : Y. Nir, et al. > Filename : draft-nir-ipsecme-childless-00.txt > Pages : 7 > Date : 2009-07-01 > > This document describes an extension to the IKEv2 protocol that > allows an IKE SA to be created and authenticated without generating a > child SA. > > A URL for this Internet-Draft is: > http://www.ietf.org/internet-drafts/draft-nir-ipsecme-childless-00.txt > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > Below is the data which will enable a MIME compliant mail reader > implementation to automatically retrieve the ASCII version of the > Internet-Draft. > > > > Email secured by Check Point > > > _______________________________________________ > IPsec mailing list > IPsec@ietf.org > https://www.ietf.org/mailman/listinfo/ipsec > >
_______________________________________________ IPsec mailing list IPsec@ietf.org https://www.ietf.org/mailman/listinfo/ipsec
