5

Let us consider two network entities.

            Linux1 (eth0)=============IPSEC=============Linux2(eth0)
            192.168.1.1                                192.168.1.2 

The IPSEC Tunnel is V4 over V4. When i set up this tunnel through IKE Strongswan, when i do "ipsec statusall", it shows a connection between Inner Ip's.

In this setup 1)I am thinking there is only 1 tunnel. I am confused on what is IPSEC SA and CHILD SA. I am thinking the packets from Linux1 to Linux2 will be ESP encapsulated ( if it is chosen) and the packets are supposed to go through the IPSEC tunnel. 2)Suppose there is rekeying, what is the difference between ikelifetime and ipseclifetime Thanks

migrated from crypto.stackexchange.com Apr 16 '15 at 1:05

This question came from our site for software developers, mathematicians and others interested in cryptography.

4

This probably ought to be moved to security stackexchange, but not because it's specific to a particular security product, but instead it's specific to a specific security protocol.

However, I'll try to address the questions anyways.

Before I start, I need to explain how IKE and IPSec work together. It's not like TLS (where there is one set of logical keys that protect everything); instead (using the language of the RFCs), you have 3 Security Associations within this one tunnel:

  • You have an IKE SA, that is used to protect negotiation traffic between Linux1 and Linux2 (such as negotiating traffic SAs).
  • You have an IPSec SA that is used to protect data traffic from Linux1 to Linux2
  • You have an IPSec SA that is used to protect data traffic from Linux2 to Linux1

Now, for your questions:

What is a CHILD SA?

A Child SA is any SA that was negotiated via the IKE SA. An IKE SA can be used to negotiate either SAs to protect the traffic (IPSec SAs), or it can be used to create another IKE SA. In the context you're seeing it, it's most likely a synonym for the IPSec SAs.

What is the difference between ikelifetime and ipseclifetime

No SA is eternal; they all have a best-by date; and when that expires, they go away (and hopefully replacement SAs are also negotiated, unless you're actually done with the tunnel). ikelifetime would be the lifetime of the IKE SA; ipseclifetime would be the lifetime of the IPSec SAs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.