What is a security association, and what is the SPI for?
Show the answer
Say this first
An SA is the set of agreed parameters for one direction of protected traffic: protocol, cipher, keys, lifetime, sequence counter and the traffic it applies to. IPsec SAs are one-way, so a working tunnel has at least two, one inbound and one outbound, for each proxy ID pair. The SPI is a 32-bit number in every ESP or AH header that tells the receiver which of its inbound SAs, and so which keys, to use. The receiver chooses the SPI for its own inbound SA.
Go deeper
Two kinds of SA
- The IKE SA is bidirectional and only carries IKE control messages.
- IPsec SAs (Child SAs in IKEv2) are unidirectional and carry data.
Lookups
The receiver finds the SA by SPI, together with the destination address and protocol. Policy lives in the SPD (what to protect, bypass or discard); live SAs and keys live in the SAD.
The SPIs mirror between peers
R1# show crypto ipsec sa | include spi
current outbound spi: 0x5E3A91C4(1580896708)
spi: 0x9B07D2E1(2600981217)
spi: 0x5E3A91C4(1580896708)The first spi: line is under "inbound esp sas", the second under "outbound esp sas". On the peer
R2, 0x5E3A91C4 is its inbound SPI and 0x9B07D2E1 its outbound SPI.
Rekey
New SAs with new SPIs are built before the old ones expire, so for a short time both pairs exist.
They will ask next
How many SAs do you get from a crypto map whose ACL has two lines?
Two IPsec SA pairs, four SAs in total (two inbound, two outbound), plus one IKE SA to the peer.
What does an "invalid SPI" message mean?
The peer sent ESP with an SPI this router does not have, usually because one side rebooted or cleared its SAs while the other still uses the old ones. IOS logs
%CRYPTO-4-RECVD_PKT_INV_SPI. DPD, orcrypto isakmp invalid-spi-recoveryfor IKEv1, lets the two sides clean up and renegotiate.
Traps
- Saying a tunnel has one SA. IPsec SAs come in pairs, one per direction, per selector pair.