Re: 44 - nat changes and ike rekey

Mohan Parthasarathy wrote:
>
> I am okay with this. 
> 
> Note we are talking about "Changes in NAT mappings". Is it 
> okay for an implementation to implement just one of the 
> two schemes
> 
> 1) send NAT-D payloads in DPD messages, compare the response 
>     with the previou UPDATE_SA_ADDRESS response
> 2) send NAT-D payloads in DPD messages with UPDATE_SA_ADDRESSES

The spec allows the initiator to decide which way it wants to do, 
but doesn't require any particular method of choosing. Hardcoding
is obviously one valid way (but so are a configuration option
and dynamic selection based on some heuristic).

The responder will support both anyway (but doesn't really need 
additional code, since it cannot know whether a message is 
"DPD message" or something else).

Best regards,
Pasi