Re: 44 - nat changes and ike rekey

 
> Jari Arkko wrote:
> > Text proposal:
> > 
> > Section 4.4
> > 
> >      The initiator receives a NAT_DETECTION_DESTINATION_IP
> >      notification that does not match the previous UPDATE_SA_ADDRESSES
> >      response (see Section 4.7 for a more detailed description).
> > 
> > =>
> > 
> >      The initiator receives a NAT_DETECTION_DESTINATION_IP
> >      notification with a value that does not match the value in a
> >      previous UPDATE_SA_ADDRESSES response (see Section 4.7
> >      for a more detailed description).
> > 
> >      Note that this may cause an extra address update when
> >      IKE rekeying is in progress, because the 
> >      NAT_DETECTION_DESTINATION_IP
> >      notification only contains a hash of the address and some
> >      other values such as the SPIs which change upon IKE rekey.
> >      Such an extra address update is harmless, however.
> 
> Probably the "Changes in NAT Mappings" section is a better place
> for this text than 4.4. I rephrased it slightly as follows:
> 
>    Note that this approach to detecting NAT mapping changes may cause an
>    extra address update when the IKE_SA is rekeyed.  This is because the
>    NAT_DETECTION_DESTINATION_IP hash also includes the IKE SPIs, which
>    change when performing rekeying.  This unnecessary update is
>    harmless, however.
> 
I am okay with this. 

Note we are talking about "Changes in NAT mappings". Is it okay for an implementation 
to implement just one of the two schemes

 1) send NAT-D payloads in DPD messages, compare the response with the previou
     UPDATE_SA_ADDRESS response
2)  send NAT-D payloads in DPD messages with UPDATE_SA_ADDRESSES

-mohan



> Best regards,
> Pasi
> _______________________________________________
> Mobike mailing list
> [email protected]
> https://www.machshav.com/mailman/listinfo.cgi/mobike