Re: Issue 73: Port numbers in examples

I agree with what Tero is writing below. But from
what I understood we are just describing the port
numbers in the example, not adding any other new
text. Correct?

Tero Kivinen wrote:

>Yes. We simply move all IKE traffic to port 4500 immediately when we
>notice that other end supports NAT regardless whether there is NAT or
>not. The IPsec SAs are still created using normal ESP packets in case
>there is no NAT, and if we move behind NAT then we change those IPsec
>SAs to use UDP encapsulation too. If we move away from NAT then we
>again disable the UDP encapsulation of IPsec packets, but keep the IKE
>traffic on port 4500.
>
>The reason for this is that if we would do the port switch when we
>later detect NAT, it would cause the additional complexity, as
>responder do not know the addresses that are going to be used in the
>encapsulated packets, as initiator wouldn't had sent any packets with
>those addresses and NAT wouldn't have created mapping for the packets
>yet. 
>  
>