Title

  Test IKEv2.EN.I.1.2.4.3: Lifetime of IKE_SA expires
  Part A: (BASIC)

Purpose

  To verify an IKEv2 device properly recognizes the lifetime of IKE_SA.

References

  * [RFC 4306] - Sections 2.8

Test Setup

  * Network Topology
      Connect the devices according to the Common Topology.
  * Configuration
      In each part, configure the devices according to the Common Configuration.
      In addition, set IKE_SA Lifetime to 60 seconds and set CHILD_SA Lifetime to 300
      seconds.
  * Pre-Sequence and Cleanup Sequence
      IKEv2 on the NUT is disabled after each part.

Procedure

   NUT                  TN1
(End-Node)           (End-Node)
    |                    |
    |------------------->| IKE_SA_INIT request (HDR, SAi1, KEi, Ni)
    |                    | (Judgement #1)
    |<-------------------| IKE_SA_INIT Response (HDR, SAr1, KEr, Nr)
    |                    | (Packet #1)
    |                    |
    |------------------->| IKE_AUTH request (HDR, SK {IDi, AUTH, N, SAi2, TSi, TSr})
    |                    | (Judgement #2)
    |<-------------------| IKE_AUTH Response (HDR, SK {IDr, AUTH, N, SAr2, TSi, TSr})
    |                    | (Packet #2)
    |                    |
    |<-------------------| INFORMATIONAL request (HDR, SK {})
    |                    | (Packet #3)
    |------------------->| INFORMATIONAL response (HDR, SK {})
    |                    | (Judgement #3)
    |                    |
    |                    * wait until retrans timer expires
    |                    |
    |<-------------------| INFORMATIONAL request (HDR, SK {})
    |                    | (Packet #4)
    |---------X          | INFORMATIONAL response (HDR, SK {})
    |                    | (Judgement #5)
    |                    |
    V                    V


 N: USE_TRANSPORT_MODE

Packet #1	See Common Packet #2
Packet #2	See Common Packet #4
Packet #3	See Common Packet #17
Packet #4	See Common Packet #17

  Part A: (BASIC)
     1. NUT starts to negotiate with TN1 by sending IKE_SA_INIT request.
     2. Observe the messages transmitted on Link A.
     3. TN1 responds with an IKE_SA_INIT response to the NUT.
     4. Observe the messages transmitted on Link A.
     5. After reception of IKE_AUTH request from the NUT, TN1 responds with an IKE_AUTH
         response to the NUT
     6. TN1 transmits an INFORMATIONAL request with no payloads to the NUT.
     7. Observe the messages transmitted on Link A.
     8. TN1 waits for the event of a timeout on the NUT.
     9. After timeout of CHILD_SA on the NUT, TN1 transmits an INFORMATIONAL request
         with no payloads using already expired IKE_SA.
     10. Observe the messages transmitted on Link A.

Observable Results

  Part A
       Step 2: Judgment #1
       The NUT transmits an IKE_SA_INIT request including "ENCR_3DES",
       "PRF_HMAC_SHA1", "AUTH_HMAC_SHA1_96" and "D-H group 2" as proposed
       algorithms.

       Step 4: Judgment #2
       The NUT transmits an IKE_AUTH request including "ENCR_3DES",
       "AUTH_HMAC_SHA1_96" and "No Extended Sequence Numbers" as proposed algorithms.

       Step 7: Judgment #3
       The NUT responds with an INFORMATIONAL response with no payloads.

       Step 10: Judgment #4
       The NUT does not respond with an INFORMATIONAL response with no payloads using
       already expired IKE_SA.

Possible Problems

  * Each NUT has the different lifetime of SA.