Re: Issue 71: Failing RR (was: Do we need text about failing RR)

Tero Kivinen wrote:

>I think we need new section probably after "Failure Recover and
>Timeouts" explaining DPD behavior:
>
>X.X Dead Peer Detection
>
>  MOBIKE protocol uses same DPD method than normal IKEv2, but as the
>  IP addresses might change in the MOBIKE also they should be taken
>  account when determing whether the other peer is alive and in sync
>  with address updates. This means that, if there is incoming traffic,
>  but that does not use current address pair, that should not be
>  considered to proof that the other end is alive. 
>  
>
OK. Somewhat edited version below:

   "MOBIKE uses the same Dead Peer Detection
    method as normal IKEv2, but as addresses may change, it is
    not sufficient to just verify that the peer is alive, but also that
    it is synchronized with the address updates and has not, for
    instance, ignored an address update due to failure to complete
    return routability test. This means that when there are incoming
    IPsec packets, MOBIKE nodes SHOULD inspect the addresses used
    in those packets and determine that they correspond to those
    that should be employed. If they do not, such packets SHOULD
    NOT be used as evidence that the peer is able to communicate
    with this node and or that the peer has received all address
    updates."

--Jari