IKEv2 support for per-queue Child SAs

Document Type Replaced Internet-Draft (individual)
Authors Antony Antony  , Steffen Klassert  , Paul Wouters 
Last updated 2021-02-22
Replaced by draft-pwouters-ipsecme-multi-sa-performance
Stream (None)
Intended RFC status (None)
Expired & archived
plain text xml pdf htmlized bibtex
Stream Stream state (No stream defined)
Consensus Boilerplate Unknown
RFC Editor Note (None)
IESG IESG state Replaced by draft-pwouters-ipsecme-multi-sa-performance
Telechat date
Responsible AD (None)
Send notices to (None)

This Internet-Draft is no longer active. A copy of the expired Internet-Draft can be found at


This document defines two Notification Payloads for the Internet Key Exchange Protocol Version 2 (IKEv2): NUM_QUEUES and QUEUE_INFO. These payloads add support for indicating that the negotiating of multiple identical Child SAs are to be used to optimize performance based on the number of queues or CPUs, or to create multiple Child SAs for different Quality of Service (QoS) levels. It indicates that a newer idetnical Child SA should not be interpreted as a replacement Child SA. Using multiple identical Child Sa's has the benefit that each stream has its own Sequence Number, ensuring that CPU's don't have to synchronize their crypto state or disable their packet replay detection.


Antony Antony (antony.antony@secunet.com)
Steffen Klassert (steffen.klassert@secunet.com)
Paul Wouters (pwouters@redhat.com)

(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)