Re: Issue: NAT-T interaction (#3)

 In your previous mail you wrote:

   I agree. But this would still leave some corner cases to worry about,
   such as having a multihomed scenario with one side having a NAT and
   the other not. Of course, you can move to NAT-T even on that case,
   but then you won't be able to let the peer know your two addresses;
   NAT-T only remembers the latest address. This may have an impact
   if we want the peer to attempt failover based on a communication
   problem with the current address.
   
=> this is somthing that MOBIKE can't solve by itself because of
the way NATs "work". My proposal is to send an informational
message to the peer behind the NAT with the extra other peer addresses,
so it will be able to open parallel IKE and IPsec SAs using these
addresses.

Regards

[email protected]

PS: the issue is the NAT cannot know all the addresses belong to the same
node and may use different mapping for the peer behind it (and will use
if there is more than IPsec node behind it).