RFC 3706
A Traffic-Based Method of Detecting Dead Internet Key Exchange (IKE) Peers
RFC 3706: A Traffic-Based Method of Detecting Dead Internet Key Exchange (IKE) Peers 💖 (Part 1 of 3)
Okay bestie, let's get the vibes straight first 🎀. This is RFC 3706, filed under the Informational category, which means it's sharing info with the Internet community and not a standard 🦋. It was written by G. Huang, S. Beaulieu, and D. Rochefort, all from Cisco Systems, Inc., and it's dated February 2004 🌸. Its header doesn't list anything it obsoletes or updates, so no drama there ✨.
Status of this Memo ⭐
Lowkey the most important bit of this section: this memo provides information for the Internet community. It does not specify an Internet standard of any kind, and distribution of it is unlimited 🌈.
Copyright Notice 💅
Copyright (C) The Internet Society (2004). All Rights Reserved. Legal stuff, but it's giving official 💜.
Abstract 🦋
This doc describes a method for detecting a dead Internet Key Exchange (IKE) peer, and it's already in use by a bunch of vendors 🔥. It's called Dead Peer Detection (DPD), and it uses IPSec traffic patterns to cut down on how many IKE messages you need to confirm liveliness. Like other keepalive mechanisms, DPD is needed to figure out when to do IKE peer failover and to reclaim lost resources 🧚.
Table of Contents 🍓
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Document Roadmap . . . . . . . . . . . . . . . . . . . . . . . 3
3. Rationale for Periodic Message Exchange for Proof of
Liveliness . . . . . . . . . . . . . . . . . . . . . . . . . . 3
4. Keepalives vs. Heartbeats . . . . . . . . . . . . . . . . . . 3
4.1. Keepalives . . . . . . . . . . . . . . . . . . . . . . . 3
4.2. Heartbeats . . . . . . . . . . . . . . . . . . . . . . . 5
5. DPD Protocol . . . . . . . . . . . . . . . . . . . . . . . . . 6
5.1. DPD Vendor ID. . . . . . . . . . . . . . . . . . . . . . 7
5.2. Message Exchanges. . . . . . . . . . . . . . . . . . . . 7
5.3. NOTIFY(R-U-THERE/R-U-THERE-ACK) Message Format . . . . . 8
5.4. Impetus for DPD Exchange . . . . . . . . . . . . . . . . 9
5.5. Implementation Suggestion. . . . . . . . . . . . . . . . 9
5.6. Comparisons. . . . . . . . . . . . . . . . . . . . . . . 10
6. Resistance to Replay Attack and False Proof of Liveliness. . . 10
6.1. Sequence Number in DPD Messages. . . . . . . . . . . . . 10
6.2. Selection and Maintenance of Sequence Numbers. . . . . . 11
7. Security Considerations. . . . . . . . . . . . . . . . . . . . 11
8. IANA Considerations. . . . . . . . . . . . . . . . . . . . . . 12
9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 12
9.1. Normative Reference. . . . . . . . . . . . . . . . . . . 12
9.2. Informative References . . . . . . . . . . . . . . . . . 12
10. Editors' Addresses . . . . . . . . . . . . . . . . . . . . . . 12
11. Full Copyright Statement . . . . . . . . . . . . . . . . . . . 131. Introduction ✨
Okay so picture this 🫶. When two peers talk to each other using IKE [2] and IPSec [3], connectivity between them can just die out of nowhere 💀. That can happen because of routing problems, one host rebooting, or whatever else, and usually IKE and IPSec have no way of noticing the peer is gone. So the SAs just hang around until their lifetimes naturally expire, and you get a "black hole" situation where packets get tunneled straight to oblivion 🕳️. It's really important to spot black holes ASAP so an entity can fail over to a different peer quickly. And sometimes you need to detect them so you can recover lost resources too 💅.
Now, people have already tried to solve dead-IKE-peer detection by sending periodic HELLO/ACK messages to prove liveliness 🌸. These schemes tend to be either unidirectional (just a HELLO) or bidirectional (a HELLO/ACK pair). For this doc, the term "heartbeat" means a unidirectional message that proves liveliness, and the term "keepalive" means a bidirectional message 💜.
The problem with these heartbeat and keepalive proposals is that they rely on messages being sent at regular intervals 😭. In an implementation, that means managing some timer to service those intervals. And since fast detection of a dead peer is usually wanted, the messages have to go out pretty frequently, which adds a whole lot of overhead for message processing 🙈. If you're managing tons of simultaneous IKE sessions, those regular heartbeats and keepalives are just not feasible 🚫.
So a bunch of vendors built their own approach to detect peer liveliness without sending messages at regular intervals 🔥. This informational doc describes what those implementations are currently doing. The scheme is called Dead Peer Detection (DPD), and it relies on IKE Notify messages to query the liveliness of an IKE peer 🦋.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC-2119 [1] 📚.
2. Document Roadmap 🗺️
As I mentioned above, there are already solutions out there for detecting dead peers 🌈. Section 3 explains why an IKE message exchange is used to query a peer's liveliness. Section 4 looks at a keepalives-based approach and a heartbeats-based approach. Section 5 presents the DPD proposal in full, pointing out how DPD differs from the schemes in Section 4 and really focusing on scalability issues 📈. Section 6 digs into security issues around replayed messages and false liveliness 🔐.
3. Rationale for Periodic Message Exchange for Proof of Liveliness 🧠
Like the intro said, it's often necessary to detect that a peer is unreachable as soon as possible ⏰. IKE gives you no way to do that, apart from waiting until the rekey period and then attempting (and failing) the rekey 😤. That would mean a stretch of lost connectivity lasting for the rest of the security association (SA) lifetime, and in most deployments that is just unacceptable 🙅♀️. So you need a way to check on a peer's state whenever you want. Different methods have popped up, usually using an IKE Notify to query the peer's liveliness 🔍. These methods rely on either a bidirectional "keepalive" message exchange (a HELLO followed by an ACK) or a unidirectional "heartbeat" message exchange (a HELLO only). The next section looks at both of these schemes 👀.
4. Keepalives vs. Heartbeats 🥊
4.1. Keepalives 💖
Let's look at a keepalives scheme where peer A and peer B both need regular acknowledgements of each other's liveliness 🫶. The messages go back and forth by means of an authenticated notify payload 🔐. The two peers have to agree on how often keepalives get sent, which means some negotiation is required during Phase 1 🤝. For any prompt failover to be possible, the keepalives also must go out at pretty frequent intervals, around 10 seconds or so ⏱️. In this hypothetical keepalives scenario, peers A and B agree to exchange keepalives every 10 seconds. Basically, every 10 seconds, one peer must send a HELLO to the other. That HELLO counts as proof of liveliness for the sender 💅. In turn, the other peer must acknowledge each keepalive HELLO. If 10 seconds pass and one side hasn't received a HELLO, it sends a HELLO itself, using the peer's ACK as proof of liveliness 🔄. Getting either a HELLO or an ACK resets an entity's keepalive timer ✨. Not receiving an ACK within a certain period of time signals an error 🚨. Here's a clarification:
Scenario 1: Peer A's 10-second timer elapses first, and it sends a HELLO to B. B responds with an ACK.
Peer A: Peer B:
10 second timer fires; ------>
wants to know that B is alive;
sends HELLO.
Receives HELLO; acknowledges
A's liveliness;
<------ resets keepalive timer, sends
ACK.
Receives ACK as proof of
B's liveliness; resets timer.Scenario 2: Peer A's 10-second timer elapses first, and it sends a HELLO to B. B fails to respond. A can retransmit, in case its initial HELLO got lost. This is how peer A figures out its peer is dead 💀.
Peer A: Peer B (dead):
10 second timer fires; ------X
wants to know that B is
alive; sends HELLO.
Retransmission timer ------X
expires; initial message
could have been lost in
transit; A increments
error counter and
sends another HELLO.
---After some number of errors, A assumes B is dead, deletes SAs, and possibly initiates failover 🚑.
An advantage of this scheme is that the party who cares about the other peer's liveliness starts the message exchange 🏃♀️. In Scenario 1, peer A cares about peer B's liveliness, so peer A sends the HELLO. It's totally conceivable in this kind of scheme that peer B would never care about peer A's liveliness. In that case, the onus would always be on peer A to start the exchange 😮💨.
4.2. Heartbeats 💜
Now compare that with a proof-of-liveliness scheme using unidirectional (unacknowledged) messages 🦋. An entity that cares about its peer's liveliness would rely on the peer itself to send periodic messages showing liveliness 🌸. In this kind of scheme, the message exchange might look like this:
Scenario 3: Peer A and Peer B both care about each other's liveliness. Each peer depends on the other to send periodic HELLOs.
Peer A: Peer B:
10 second timer fires; ------>
sends HELLO. Timer also
signals expectation of
B's HELLO.
Receives HELLO as proof of A's
liveliness.
<------ 10 second timer fires; sends
HELLO.
Receives HELLO as proof
of B's liveliness.Scenario 4: Peer A doesn't receive a HELLO from B and marks the peer dead. This is how an entity detects its peer is dead 🪦.
Peer A: Peer B (dead):
10 second timer fires; ------X
sends HELLO. Timer also
signals expectation of
B's HELLO.
---Some time passes, and A assumes B is dead ⌛.
The downside of this scheme is that it leans on the peer to prove its own liveliness 🙃. Peer B might never care about peer A's liveliness. Even so, if A cares about B's liveliness, B has to know that and keep the state info it needs to send periodic HELLOs to A 🧾. This drawback gets super clear in the remote-access scenario 🏢. Picture a VPN aggregator terminating a huge number of sessions (on the order of 50,000 peers or so) 😳. Each peer needs pretty fast failover, so the aggregator would have to send HELLO packets every 10 seconds or so. That scheme just doesn't scale, because the aggregator would have to send 50,000 messages every few seconds 📉.
With both of these schemes (keepalives and heartbeats), some negotiation of the message interval has to happen, so each entity can know how often its peer expects a HELLO 🗓️. That immediately adds complexity 🤯. And having to send periodic messages (no matter what other IPSec/IKE activity is going on) also piles on computational overhead for the system 🥵.
5. DPD Protocol ✨
Okay so DPD is basically the glow-up for IKE keepalives and heartbeats 💅. Those older schemes make peers swap HELLOs at regular intervals no matter what. DPD is way more chill: each peer's DPD state is mostly its own business. A peer can ask for proof of liveliness whenever it actually needs it, not on a schedule 🕰️. That asynchronous vibe means fewer messages get sent, and that's how DPD gets its scalability 🫶.
Let's run through an example. Take two DPD peers, A and B. If valid IPSec traffic is flowing between them, there's basically no need for proof of liveliness, because the IPSec traffic is the proof 🙌. But if a stretch of time goes by with no packet exchange, the liveliness of each peer becomes questionable 👀. Knowing the peer is alive only really matters if there's something to send. So if peer A has IPSec packets to send after that quiet period, it needs to know if B is still alive, and that's when A can kick off the DPD exchange.
Each peer can have different needs too. Peer A might need rapid failover, while peer B's need for resource cleanup is more relaxed 😌. In DPD, each peer gets to set its own "worry metric", an interval that describes how urgent the DPD exchange is. Continuing the example, peer A might set its DPD interval to 10 seconds. So if A sends outbound IPSec traffic but doesn't get any inbound traffic for 10 seconds, it can start a DPD exchange.
Peer B, meanwhile, is less stressed, so its DPD interval is 5 minutes. If the IPSec session sits idle for 5 minutes, B can start a DPD exchange the next time it sends IPSec packets to A.
Important: when to start a DPD exchange is an implementation specific decision 🧠. An implementation could even send DPD messages at regular intervals after idle periods. Check out section 5.5 for more implementation ideas.
5.1. DPD Vendor ID
To show off DPD capability, an entity has to send the DPD vendor ID 💖. Both peers of an IKE session MUST send the DPD vendor ID before any DPD exchanges can begin. Here's the format:
1
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! !M!M!
! HASHED_VENDOR_ID !J!N!
! !R!R!
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Where HASHED_VENDOR_ID is the following value, and MJR and MNR correspond to the current major and minor version of this protocol (1 and 0 respectively):
{0xAF, 0xCA, 0xD7, 0x13, 0x68, 0xA1, 0xF1,
0xC9, 0x6B, 0x86, 0x96, 0xFC, 0x77, 0x57}An IKE peer MUST send the Vendor ID if it wishes to take part in DPD exchanges 🎀.
5.2. Message Exchanges
The DPD exchange is a bidirectional (HELLO/ACK) Notify message 🦋. It goes like this:
Sender Responder
-------- -----------
HDR*, NOTIFY(R-U-THERE), HASH ------>
<------ HDR*, NOTIFY(R-U-THERE-
ACK), HASHThe R-U-THERE message corresponds to a "HELLO" and the R-U-THERE-ACK corresponds to an "ACK." Both are just ISAKMP Notify payloads, and this document defines these two new ISAKMP Notify message types:
Notify Message Value
R-U-THERE 36136
R-U-THERE-ACK 36137An entity that has sent the DPD Vendor ID MUST respond to an R-U-THERE query. Furthermore, an entity MUST reject unencrypted R-U-THERE and R-U-THERE-ACK messages 🚫.
5.3. NOTIFY(R-U-THERE/R-U-THERE-ACK) Message Format
When sent, the R-U-THERE message MUST take the following form 📋:
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Next Payload ! RESERVED ! Payload Length !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Domain of Interpretation (DOI) !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Protocol-ID ! SPI Size ! Notify Message Type !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! !
~ Security Parameter Index (SPI) ~
! !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Notification Data !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+As this message is an ISAKMP NOTIFY, the Next Payload, RESERVED, and Payload Length fields should be set accordingly. The remaining fields are set as:
- Domain of Interpretation (4 octets) - SHOULD be set to IPSEC-DOI.
- Protocol ID (1 octet) - MUST be set to the protocol ID for ISAKMP.
- SPI Size (1 octet) - SHOULD be set to sixteen (16), the length of two octet-sized ISAKMP cookies.
- Notify Message Type (2 octets) - MUST be set to R-U-THERE
- Security Parameter Index (16 octets) - SHOULD be set to the cookies of the Initiator and Responder of the IKE SA (in that order)
- Notification Data (4 octets) - MUST be set to the sequence number corresponding to this message
The format of the R-U-THERE-ACK message is the same, with one exception: the Notify Message Type MUST be set to R-U-THERE-ACK 🔁. Again, the Notification Data MUST be sent to the sequence number corresponding to the received R-U-THERE message.
5.4. Impetus for DPD Exchange
Again, DPD doesn't rely on some negotiated time interval to force messages to be exchanged 🙅♀️. DPD does not mandate the exchange of R-U-THERE messages at any time. Instead, an IKE peer SHOULD send an R-U-THERE query to its peer only if it's interested in that peer's liveliness 👀. So if traffic is regularly exchanged between two peers, either peer SHOULD use that traffic as proof of liveliness, and both peers SHOULD NOT initiate a DPD exchange 😎.
A peer MUST keep track of the state of a given DPD exchange 📍. Once it has sent an R-U-THERE query, it expects an ACK in response within some implementation-defined period of time. An implementation SHOULD retransmit R-U-THERE queries when it fails to receive an ACK. After some number of retransmitted messages, an implementation SHOULD assume its peer is unreachable and delete IPSec and IKE SAs to the peer 💀.
5.5. Implementation Suggestion
Since a peer's liveliness is only questionable when no traffic is being exchanged, a viable implementation might begin by monitoring idleness 🕵️♀️. Along these lines, a peer's liveliness only matters when there's outbound traffic to send. So an implementation can initiate a DPD exchange (i.e., send an R-U-THERE message) after some period of idleness, followed by the desire to send outbound traffic. Likewise, an entity can initiate a DPD exchange if it has sent outbound IPSec traffic but hasn't received any inbound IPSec packets in response. A complete DPD exchange (i.e., transmission of R-U-THERE and receipt of the corresponding R-U-THERE-ACK) will serve as proof of liveliness until the next idle period 🌸.
Again, since DPD doesn't mandate any interval, this "idle period" (or "worry metric") is left as an implementation decision. It is not a negotiated value 🙃.
5.6. Comparisons
Here's the tea ☕. The performance benefit DPD offers over traditional keepalives and heartbeats schemes comes from the fact that regular messages don't need to be sent 🍓. Returning to the examples in section 4.1, a keepalive implementation such as the one presented would need one timer to signal when to send a HELLO message, and another timer to "timeout" the ACK from the peer (this could also be the retransmit timer). Similarly, a heartbeats scheme such as the one presented in section 4.2 would need to keep one timer to signal when to send a HELLO, plus another timer to signal the expectation of a HELLO from the peer.
By contrast, a DPD scheme only needs to keep a timestamp of the last received traffic from the peer (which marks the beginning of the "idle period") ⏱️. Once a DPD R-U-THERE message has been sent, an implementation only needs a timer to signal retransmission. So the need to maintain active timer state is reduced, which gives a scalability improvement (assuming maintaining a timestamp is less costly than an active timer). Furthermore, since a DPD exchange only occurs if an entity hasn't received traffic recently from its peer, the number of IKE messages to be sent and processed is also reduced. As a result, the scalability of DPD is much better than keepalives and heartbeats 👑.
DPD keeps the HELLO/ACK model from keepalives, since an exchange is only initiated by an entity interested in the liveliness of its peer 🧚.
6. Resistance to Replay Attack and False Proof of Liveliness 🛡️
6.1. Sequence Number in DPD Messages
To guard against message replay attacks and false proof of liveliness, a 32-bit sequence number MUST be included with each R-U-THERE message 🔐. A responder to an R-U-THERE message MUST send an R-U-THERE-ACK with the same sequence number. When the R-U-THERE-ACK arrives, the initial sender SHOULD check the validity of the sequence number. The initial sender SHOULD reject the R-U-THERE-ACK if the sequence number doesn't match the one sent with the R-U-THERE message 🚨.
Additionally, both the receiver of the R-U-THERE and the receiver of the R-U-THERE-ACK message SHOULD check the validity of the Initiator and Responder cookies presented in the SPI field of the payload 🍪.
6.2. Selection and Maintenance of Sequence Numbers
As both DPD peers can initiate a DPD exchange (i.e., both peers can send R-U-THERE messages), each peer MUST maintain its own sequence number for R-U-THERE messages 🔢. The first R-U-THERE message sent in a session MUST be a randomly chosen number. To keep the counter from rolling past the 32-bit boundary, the high-bit of the sequence number initially SHOULD be set to zero. Subsequent R-U-THERE messages MUST increment the sequence number by one. Sequence numbers MAY reset at the expiry of the IKE SA, moving to a newly chosen random number. Each entity SHOULD also maintain its peer's R-U-THERE sequence number, and an entity SHOULD reject the R-U-THERE message if it fails to match the expected sequence number 💅.
Implementations MAY maintain a window of acceptable sequence numbers, but this specification makes no assumptions about how that's done. Again, it's an implementation specific detail 🌈.
7. Security Considerations ✨
okay so DPD uses sequence numbers to keep liveliness checks honest, and this section is about why sequence numbers are the better pick over random nonces 💅
sequence numbers do make each peer keep some state, true. but they also protect you from certain replay attacks, and that's a huge win 🛡️ say peer A sends peer B a valid DPD R-U-THERE message. now an attacker C intercepts it and floods B with copies. B still has to decrypt and process every single packet, no matter whether sequence numbers or nonces are in use 😩 the difference is that with sequence numbers, B can tell the packets are replays, because their sequence numbers won't match the incremented one B expects from A. that means B doesn't have to build, encrypt, and send ACKs for them. it's giving efficiency 🙌 with nonces, though, there's no way for B to spot the replays (unless B keeps a list of recently received nonces). not iconic.
there's also a bonus: sequence numbers give you extra proof that the peer is still alive 🫶 as long as a receiver checks that a R-U-THERE message is valid (by checking its incremented sequence number), the receiver can be sure the peer is alive, simply because the sender is the one who started the query. nonces can't give you that assurance. periodt 💜
8. IANA Considerations 🧚
no IANA action is required for this document ✨ DPD just uses notify numbers from the private range, so there's nothing to register with IANA. easy.
9. References 📚
9.1. Normative Reference
[1] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
9.2. Informative References
[2] Harkins, D. and D. Carrel, "The Internet Key Exchange (IKE)", RFC 2409, November 1998.
[3] Kent, S. and R. Atkinson, "Security Architecture for the Internet Protocol", RFC 2401, November 1998.
10. Editors' Addresses 🎀
these are the three Cisco folks who edited the doc, with their contact details:
Geoffrey Huang
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134
Phone: (408) 525-5354
EMail: ghuang@cisco.com
Stephane Beaulieu
Cisco Systems, Inc.
2000 Innovation Drive
Kanata, ON
Canada, K2K 3E8
Phone: (613) 254-3678
EMail: stephane@cisco.com
Dany Rochefort
Cisco Systems, Inc.
124 Grove Street, Suite 205
Franklin, MA 02038
Phone: (508) 553-8644
EMail: danyr@cisco.com11. Full Copyright Statement 🔒
the Internet Society owns the copyright (2004). this doc is covered by the rights, licenses, and restrictions in BCP 78, and apart from those, the authors keep all their rights 💜
the document and everything in it is handed over "AS IS", and the lovely people involved (the contributor, whoever they represent or are sponsored by, the Internet Society, and the IETF) are not making any promises:
THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property 🦋
the IETF doesn't take a position on whether any intellectual property rights that might cover this technology are valid or how far they reach, nor on whether a license for them would be available. it also doesn't claim to have done its own search for such rights. info on how rights work for RFC docs is in BCP 78 and BCP 79.
copies of IPR disclosures sent to the IETF Secretariat are available, along with any licensing assurances, or the results of any attempt to get a general license or permission for implementers or users of this spec. you can find them in the IETF online IPR repository at http://www.ietf.org/ipr.
the IETF also invites anyone to flag any copyrights, patents, patent applications, or other proprietary rights that might cover technology needed to implement this standard. send that info to the IETF at ietf-ipr@ietf.org 🫶
Acknowledgement 🌈
funding for the RFC Editor function is currently provided by the Internet Society. thank you to them, and thank you for reading all the way to the end, bestie 💖
📦 where this page comes from
- ietf: rfc3706 2004-02
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms