Re: Issue: Support for IPv4 - IPv6 movements (#13)

 

> In your previous mail you wrote:
> 
>    The SCTP requirement is to map sets of S/D addresses to a single SA 
>    via the SPD, which we do.
> 
> => this is about inner addresses aka traffic selectors as the SPD
> knows only them, isn't it?
> 
>    The RFC also calls for mapping traffic 
>    from a set of destination addresses to a single SA, via the SAD. This 
>    is something that 2401bis accommodates, in the discussion of inbound 
>    traffic processing in Section 5.2, step 2, so long as we interpret 
>    the phrase  "If the packet appears to be IPsec protected and it is 
>    addressed to this device" as allowing multiple addresses for the 
>    IPsec device. We will add a note to clarify this.
>    
> => fine, so the inbound case is solved by the introduction of
> suitable flexibility. But the outbound case is not and IMHO
> to require the support of multiple simultaneous outer addresses
> is a bad idea. Of course in an IKE context (as MOBIKE) IPsec SAs
> come by pairs and we can't ignore the outbound issue...
> 
RFC 3554 allows you to negotiate a single SA for multiple traffic selectors (See
section 3). As SAs come in pairs, it applies to both outbound and inbound SAs.
So, what is the problem in supporting multiple outer addresses for outbound SA
selection ? Is it an implementation problem ?

-thanks
mohan

> Thanks
> 
> [email protected]
> _______________________________________________
> Mobike mailing list
> [email protected]
> https://www.machshav.com/mailman/listinfo.cgi/mobike