> >> Here is one paragraph from RFC 3588 (Diameter Base Protocol):
> >>
> >> "Note that IPsec is considerably less flexible than TLS
> when it comes to
> >> configuring root CAs. Since use of Port identifiers is prohibited
> >> within IKE
> >> Phase 1, within IPsec it is not possible to uniquely
> configure trusted
> >> root
> >> CAs for each application individually; the same policy
> must be used
> >> for all
> >> applications. This implies, for example, that a root CA
> trusted for
> >> use with
> >> Diameter must also be trusted to protect SNMP. These
> restrictions can be
> >> awkward at best.
> >> Since TLS supports application-level granularity in certificate
> >> policy, TLS
> >> SHOULD be used to protect Diameter connections between
> administrative
> >> domains. IPSec is most appropriate for intra-domain usage
> when pre-shared
> >> keys are used as a security mechanism."
>
> Scott G. Kelly wrote:
>
> > It's wrong. Granted, the original IPsec RFC's were not very clear on how
> > you configure something like this, but what is discussed above is an
> > implementation problem probably resulting from a design decision to only
> > permit one IKE SA between a given endpoint pair. It has always been
> > possible to use granular per-port policies, and if a particular
> > implementation does not support this, it's not because of a restriction
> > in the IPsec standard.
Have suggestions for an eratta entry?
John
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.