Name: draft-nir-ikev2-auth-lt-01
Title: Repeated Authentication in IKEv2
State: Active
Authors: Yoav Nir
Group: Individual Submissions (none)
Date: 2004-11-16
With some IPsec peers, particularly in the remote access scenario, it is
desirable to repeat the mutual authentication periodically. The purpose of
this is to limit the time that SAs can be used by a third party who has
gained control of the IPsec peer. This is not the same as IKE SA rekeying,
and need not be tied to it. Repeated authentication can be achieved by
simply repeating the Initial exchange by whichever side has a stricter
policy. However, in the remote access scenario it is usually up to a human
user to supply the authentication credentials, and often EAP is used for
authentication, which makes it unreasonable or impossible for the remote
access gateway to initiate the exchange. This document describes how the
original Responder can send a notification to the Initiator with the number
of seconds before the authentication needs to be repeated. The Initiator
will repeat the Initial exchange before that time is expired. If the
Initiator fails to do so, the Responder may close all tunnels.
[sh-index] Back to list of manuals
|
| |
