This has been discussed endlessly in the workgroup since '95. It has always been voted down. I even think there is yet another Internet Draft right now with yet another proposal.
This does present 'challenges' to dead peer detection and recovery.
so you are telling me...that if i setup an net to net ipsec connection and check that the connection is up...ie I can ping the computers on the remote network and then i walk away and leave the connection up and running while I am away the ipsec connection is using NO BANDWITH??
how does it keep the connection between the two networks alive? or am i misunderstanding how a net to net connection works...so far i have only setup a client to firewall connection (please forgive my ignorance)
Yes I am telling you that once the VPN 'comes up', it consumes no bandwidth.
The IKE timers determine what is happening.
SAs DO timeout!!!
If you set your Main Mode timer at 24 hours and your Quick Mode timer at 8 hours, and if the QM timer clicks and THEN there is data, QM is negotiated before the data flows. If the MM timer clicks, and then data, both MM and QM is negotiated before letting data through.
We have seen TCP timeouts from TELNETs (particularly TN3270) that have been let idle for hours and then the user does something.
The connection is NEVER 'kept alive'.
Rather the Security Association has timers as to when it needs to be rekeyed. 'Stale' SA removal is left to the individual implementations. And that was yet another hotly debated point.
With Net to Net, a packet on the interface starts IKE. IKE has timers for rekeying. that is all.
Yes I am telling you that once the VPN 'comes up', it consumes no bandwidth.
The IKE timers determine what is happening.
SAs DO timeout!!!
If you set your Main Mode timer at 24 hours and your Quick Mode timer at 8 hours, and if the QM timer clicks and THEN there is data, QM is negotiated before the data flows. If the MM timer clicks, and then data, both MM and QM is negotiated before letting data through.
We have seen TCP timeouts from TELNETs (particularly TN3270) that have been let idle for hours and then the user does something.
The connection is NEVER 'kept alive'.
Rather the Security Association has timers as to when it needs to be rekeyed. 'Stale' SA removal is left to the individual implementations. And that was yet another hotly debated point.
With Net to Net, a packet on the interface starts IKE. IKE has timers for rekeying. that is all.
