Re: [Ipsec] Reauthentication in IKEv2

[Yoav Nir <ynir at checkpoint.com>]

A zero value would mean "reauthenticate now", but usually in such a 
case the gateway is not going to follow this notification with a delete 
immediately.

I would much rather have the gateway sending "reauth within 5 minutes"

On Nov 11, 2004, at 3:58 AM, Bill Sommerfeld wrote:

> On Wed, 2004-11-10 at 20:27, Geoffrey Huang wrote:
>
> > I can see arguments from both sides, I guess.  Even with your re-auth
> > scheme, a value of "0" seconds could mean "do it now," right?
>
> I'd think so; I'd also hope that the encoding should also allow for
> "reauth in 8 hours" notifications as well.
>
> As was pointed out in the secsh working group yesterday for a related
> user-authentication timeout, there are also accessibility concerns 
> here;
> some people enter text *very* slowly; 3 minutes may not be sufficient
> for some.

That is the reason why the gateway should send it together with the 
last packet of the IKE_AUTH exchange.  It might, for example, be a good 
idea for the client software to pop up an authentication dialog 3 
minutes before the authentication timeout elapses, but do it 3 extra 
minutes earlier if accessibility options are turned on.  It's 
definitely a client-side decision.


_______________________________________________
Ipsec mailing list
Ipsec at ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec