[IPsec] Matching certificates in IKEv2

Hi While working on some text for the AD-VPN document, I came across some weirdness in the base IKEv2 specification: The IDi and IDr payloads have any of several types: ID_IPV4_ADDR, ID_FQDN, ID_RFC822_ADDR, ID_IPV6_ADDR, ID_DER_ASN1_DN, ID_DER_ASN1_GN, and ID_KEY_ID. Section 4 (conformance r

[IPsec] Internal Address Expiry in IKEv2

Hi all How does a Security Gateway specify the validity or duration of an IP Address via CP ? The INTERNAL_ADDRESS_EXPIRY seems deprecated ? So if the Security Gateway has a notion of lease time, it just has to go and delete the tunnel when the address expires and the client sets up the tunnel