Re: 44 - nat changes and ike rekey

Jari Arkko wrote:
> Text proposal:
> 
> Section 4.4
> 
>      The initiator receives a NAT_DETECTION_DESTINATION_IP
>      notification that does not match the previous UPDATE_SA_ADDRESSES
>      response (see Section 4.7 for a more detailed description).
> 
> =>
> 
>      The initiator receives a NAT_DETECTION_DESTINATION_IP
>      notification with a value that does not match the value in a
>      previous UPDATE_SA_ADDRESSES response (see Section 4.7
>      for a more detailed description).
> 
>      Note that this may cause an extra address update when
>      IKE rekeying is in progress, because the 
>      NAT_DETECTION_DESTINATION_IP
>      notification only contains a hash of the address and some
>      other values such as the SPIs which change upon IKE rekey.
>      Such an extra address update is harmless, however.

Probably the "Changes in NAT Mappings" section is a better place
for this text than 4.4. I rephrased it slightly as follows:

   Note that this approach to detecting NAT mapping changes may cause an
   extra address update when the IKE_SA is rekeyed.  This is because the
   NAT_DETECTION_DESTINATION_IP hash also includes the IKE SPIs, which
   change when performing rekeying.  This unnecessary update is
   harmless, however.

Best regards,
Pasi