Re: Scope of SA change in design document..

--- Tero Kivinen <[email protected]> wrote:

> Mohan Parthasarathy writes:
> > I think there is a bigger issue here. You can't
> have
> > one SA and have multiple flows/packets going over
> > different paths because if their path
> charecterestics
> > are different, the replay check would drop the
> > packets. Unless ESP can maintain per-address
> > sequence numbers, how this would be possible.
> > Perhaps this could be mentioned as a design point.
> > I don't remember whether this was discussed before
> > or not.
> 
> Actually that is not problem with issue 8. The issue
> 8 is about moving
> only part of SAs created between two hosts. One SA
> always will use
> exactly one address pair regardless of issue 8. Our
> charter do rule
> out load balancing, i.e. using multiple addresses at
> the same time for
> single IPsec SA is explicitly ruled out for the
> group.
> 
I never mentioned issue 8 and monami6 does not know
anything about MOBIKE issues :-)

> We do already offer a way for the host to create
> separate group of SAs
> which are moved separately from each other, i.e.
> applications can
> create multiple IKE SAs, and create the IPsec SAs to
> the IKE SA having
> similar IPsec SAs. I.e. if you have 3 different
> groups of IPsec SAs
> wanting to have different charasteristics from the
> interfaces uses,
> you can create 3 IKE SAs and create those IPsec SAs
> inside each of
> those IKE SAs. Then you have 3 groups (IKE SAs)
> which you can
> separately move from one address pair to another.
> 
> You can even move the IPsec SAs from one group to
> another, by
> recreating the IPsec SA in diffenet IKE SA and then
> deleting the old
> IPsec SA from old IKE SA.
> 
> The problem with ESP sequence numbers comes only if
> we try to do
> load-balancing, i.e. use multiple different
> ip-addresses for the SAME
> IPec SA at the same time. 

My only poiny is about the design document where
one can explain this motivation. I never asked
to reopen any issues. I agree that one can use
multiple SAs for different flows. I don't think
the discussion in monami6 went that far. So,
my intention was just to explain this in the
design document.

-mohan

> -- 
> [email protected]
>