AIX

AIX is the leading enterprise class operating system providing secure, scalable, and robust infrastructure solutions for enterprises. AIX uses Internet Protocol Security (IPSec) which is an open standard security technology developed by the Internet Engineering Task Force (IETF) to enable secure communications over the Internet.

IPSec in AIX helps to provide a set of security services for traffic at the IP layer for both IPv4 and IPv6 without needing any changes to the applications. The building block on which secure communications is built is a concept known as a Security Association (SA) and tunnels are defined to manage security associations (SAs) between two hosts.

Once IPSec Phase I and Phase II tunnels get created and moved to active state, those will always remain in active state even though there is no data traffic between the end points, or an end point unexpectedly goes down. SA bundle will remain in "ACTIVE" state until their lifetime naturally expires or when user manually teardowns the tunnels. This may lead to wastage of system resources which can fail creating new SAs for other peers.

This tutorial talks about the feature introduced in AIX 7.2 TL5 – “SA Idle Timeout” which addresses aforementioned problem by deleting SAs which are idle for a specified time in order to reclaim the resources and thus optimizing IPSec tunnels.

An Introduction
When IPsec is enabled in AIX , resources must be allocated to maintain security association (SA) created between two peer nodes. The SA requires both memory and several timers to monitor the health of this SA or for KEY exchange. If a peer which is associated with this SA is idle for a long time and no real data traffic in between, then this will lead to wastage of system resources.

The objective of SA Idle Timeout is to identify the SAs those are idle and tear down corresponding tunnels which are inactive. With the introduction of “IPSec SA Idle Timeout” feature in AIX, there is now SA idle timer that can be configured to monitor the data traffic through SA. When you set an SA idle timeout interval by using the SA_IDLE_TIMEOUT option, in seconds, a timer is created to monitor the data traffic that is sent or received through SA. If there is no traffic during the specified time interval, the SA is deleted and an information message(delete payload) is sent to the associated remote peer node requesting remote peer to delete the corresponding SA.

Configuration
AIX provides a configurable option to the user for SA Idle Timeout. Setting an attribute SA_IDLE_TIMEOUT in configuration file /etc/isakmpd.conf enables SA Idle timeout. This is a global configuration and applies to all phase-2 tunnels.

• SA_IDLE_TIMEOUT is specified in seconds
• Default value for SA_IDLE_TIMEOUT is Zero
• SA_IDLE_TIMEOUT is disabled by default
• No entry for SA_IDLE_TIMEOUT in /etc/isakmpd.conf is considered Zero and will not enable SA Idle timeout
• SA_IDLE_TIMEOUT can be applied for initiator or responder or both
• SA_IDLE_TIMEOUT is applicable for only IKEv2

• Increased availability of resources
• Improved scalability of IPSec deployments as it prevents waste of resources
• Deletion of open inactive tunnels reduce the risk of security attacks
• Recommended by IKE specification thus making AIX IPSec complaint with standards