topic VPN SA question in General Topics

VPN SA question

Alex_Krikorian — Tue, 23 Apr 2019 06:41:38 GMT

Hello

i have a question. When we have a L2L VPN and we have enabled tunnel per gateway pair, it will create only one SA or only one pair of SAs? From what i know, SAs are undirectional, so the minimum we need is 2 for phase 2, am i right?

Second question, does every SA include the 'return' traffic as well (thus the whole session) or the reason we need 2nd Ipsec SA is for the return traffic? Because if it is the former, if i only need one way communication , then in theory one Ipsec SA should be enough?

Re: VPN SA question

PhoneBoy — Tue, 23 Apr 2019 17:15:35 GMT

I believe you need the second SA for the return traffic, thus they are always created in pairs.

Re: VPN SA question

Maarten_Sjouw — Tue, 23 Apr 2019 18:10:28 GMT

The SA created from site-A to B will support the session, so the forward and return traffic. It will not support a session started from site-B to A though, so there will be a new SA created for that traffic.

Re: VPN SA question

Alex1041 — Wed, 24 Apr 2019 06:49:13 GMT

I thought so, i just wanted to confirm by having my hands on a per gateway pair vpn to check it , but i didnt. So unless we want traffic initiated from both ends, one SA should be enough. Thanks for verifying!