I only heard this term today, but it was explained to me as a point-to-point VPN (so, two routers with a VPN tunnel established between them) and a firewall configured to only allow certain hosts to talk to certain other hosts (per their ip address); is this correct?

1 Answer 1


Do you think you're referring to an IPSEC Child Security Association (SA)? It's described by the specifications as a child and even has some related notification types.

To expand, Child SAs are created for policy-based IPSEC VPNs as a result of how they are implemented by routers. If you have the following configuration for a tunnel, two Child SAs are created within each router, and each SA has its own cryptographic state:

        VPN                          VPN
      Router A ---------IPSEC------ Router B
     /       \                        |
    /         \                       |
   /           \                      |

Policy-Based VPN Child SAs (possible; won't always exist):

  • <->
  • <->

Fits the description, but not sure of the context of your question.

  • 2
    That also what came to my mind reading the question. It is the more likely explanation. However in you example most router consider there's only 2 -bi directional- child SA.
    – JFL
    Dec 4, 2020 at 15:00
  • 1
    I must have remembered wrong. I'll correct my answer! Dec 4, 2020 at 15:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.