RE: SOI QUESTION: 4.3 Dead peer detection

[Henry Spencer <henry@spsystems.net>]

On Tue, 25 Jun 2002, Jan Vilhuber wrote:
> ...I don't much care for the hand-waving
> ping approach suggested by JFK, whereas IKEv2's approach is closer to
> the DPD mechanism suggested by Geoff Huang et.al. (now expired...

Also to what's suggested in draft-spencer-ipsec-ike-implementation-02.txt.

> I was also under the impression that birth-certificates were more akin
> to Initial-contact, rather than real-time detection of connectivity
> problems. The two aren't necessarily the same.

Birth certificates tackle the problem slightly differently:  they permit
authenticated, believable error reports from the other end.  This isn't
quite as useful as an IKE-level query/response mechanism, but it does
address the primary problem, dead-SA detection. 

                                                          Henry Spencer
                                                       henry@spsystems.net