[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Heartbeats (was RE: keepalives)



Paul Koning wrote:

> >>>>> "Tero" == Tero Kivinen <kivinen@ssh.fi> writes:
>
>  Tero> Jan Vilhuber writes:
>  >> What about this: when sending a phase1-heartbeat (where we still
>  >> need to agree what this would look like) from host A to host B,
>  >> why not include in it all SPI's that host A shares with host B. If
>  >> host B has a few SPI's that host A didn't include in the
>  >> heartbeat, then they are obviously deleted, and host B should
>  >> delete it's SPIS for those.
>
>  Tero> That could be one way to do it, but it only allows machine to
>  Tero> have 16376 SAs up at one time (64 kB packet limit at the UDP
>  Tero> level). I have been doing testing with bigger number of SAs
>  Tero> between hosts already now, and I wonder what amount of SAs we
>  Tero> have in 5-10 years....
>
>  Tero> Is that amount enough?
>
> 16k SAs between a single pair of security gateways?  The usual number
> is one.  Indeed, there have been some good arguments why it's unlikely
> that much more than that is useful.  (The classic argument for more is
> "so some data can be protected better than other".  But with decent
> crypto performance, a simpler solution is to protect everything to the
> maximum extent possible.)
>
> Can you give a scenario where thousands of SAs between a single pair
> of security gateways is necessary?

These are phase2 SAs and their number can be big if same gateways
are providing LAN-to-LAN connectivity. Phase 2 SAs are created for
differnet combinations of IP addresses and Ports,so they can be large.

In some implementations, memory is very premium and it may be very
difficult to send bigger UDP packets. In some implementations, all
the UDP data needs to be sent to the TCP/IP stack at once, and
it may not be able to allocate 64K byte memory block to store all
the phase2 SAs SPIs.

I feel, it is better to indicate which SAs are alive in the sender side
in more than one packet and at different times.

On receiving side, if it does not receive any keep alives for certain
period of time for SAs, then it will delete them.

>
>
>         paul

Regards
Srini
References: