Re: Issue: Support for IPv4 - IPv6 movements (#13)

At 11:25 AM +0200 6/26/04, Francis Dupont wrote:
>  In your previous mail you wrote:
>
>    The SCTP requirement is to map sets of S/D addresses to a single SA
>    via the SPD, which we do.
>
>=> this is about inner addresses aka traffic selectors as the SPD
>knows only them, isn't it?

yes.

>    The RFC also calls for mapping traffic
>    from a set of destination addresses to a single SA, via the SAD. This
>    is something that 2401bis accommodates, in the discussion of inbound
>    traffic processing in Section 5.2, step 2, so long as we interpret
>    the phrase  "If the packet appears to be IPsec protected and it is
>    addressed to this device" as allowing multiple addresses for the
>    IPsec device. We will add a note to clarify this.
>   
>=> fine, so the inbound case is solved by the introduction of
>suitable flexibility. But the outbound case is not and IMHO
>to require the support of multiple simultaneous outer addresses
>is a bad idea. Of course in an IKE context (as MOBIKE) IPsec SAs
>come by pairs and we can't ignore the outbound issue...
>

Yes, outbound is problematic.  2401/bis is not comprehensive in this 
regard, anyway.  Note that we allude to the problem of finding a 
security gateway that services a set of hosts, but that we don't say 
exactly how to solve the problem, since there is not Wg agreement on 
how to do this.

Steve