Difference between IPSEC SA and CHILD SA

Question

Let us consider two network entities.

            Linux1 (eth0)=============IPSEC=============Linux2(eth0)
            192.168.1.1                                 192.168.1.2 

The IPSEC Tunnel is V4 over V4. When i set up this tunnel through IKE Strongswan, when i do "ipsec statusall", it shows a connection between Inner IP's.

In this setup

1. I think there is only 1 tunnel. I am confused on what is IPSEC SA and CHILD SA. I think the packets from Linux1 to Linux2 will be ESP encapsulated (if it is chosen) and the packets are supposed to go through the IPSEC tunnel.
2. Suppose there is rekeying, what is the difference between ikelifetime and ipseclifetime?

Answer 1

Before I start, I need to explain how IKE and IPSec work together. It's not like TLS (where there is one set of logical keys that protect everything); instead (using the language of the RFCs), you have 3 Security Associations within this one tunnel:

• You have an IKE SA, that is used to protect negotiation traffic between Linux1 and Linux2 (such as negotiating traffic SAs).
• You have an IPSec SA that is used to protect data traffic from Linux1 to Linux2
• You have an IPSec SA that is used to protect data traffic from Linux2 to Linux1

Now, for your questions:

What is a CHILD SA?

A Child SA is any SA that was negotiated via the IKE SA. An IKE SA can be used to negotiate either SAs to protect the traffic (IPSec SAs), or it can be used to create another IKE SA. In the context you're seeing it, it's most likely a synonym for the IPSec SAs.

What is the difference between ikelifetime and ipseclifetime

No SA is eternal; they all have a best-by date; and when that expires, they go away (and hopefully replacement SAs are also negotiated, unless you're actually done with the tunnel). ikelifetime would be the lifetime of the IKE SA; ipseclifetime would be the lifetime of the IPSec SAs.