Re: Changes in NAT mapping

Eric Fung wrote:

> 1) When the initiator detects a change in its NAT mapping (from a
> received NAT_DETECTION_DESTINATION_IP payload), it does not 
> actually know what the new mapping is, and hence, following 
> Sec. 3.5, does nothing to change its IKE_SA, correct? It only 
> sends UPDATE_SA_ADDRESSES to tell the peer to update its SAs' 
> tunnel endpoints.

Correct; since the IKE_SA doesn't contain the old mapping (initiator
does not know it), there's nothing to update there when the mapping
changes.

> 2) Can other INFORMATIONAL exchanges be used to detect changes in
> NAT mapping?  Sec 3.8 seems to imply only the IKE_SA_INIT exchange
> and exchanges containing UPDATE_SA_ADDRESSES should be used.

Section 3.8 says that "the NAT_DETECTION_SOURCE_IP and
NAT_DETECTION_DESTINATION_IP notifications MAY be included in 
any INFORMATIONAL request", so the request does not have to
contain UPDATE_SA_ADDRESSES.

Best regards,
Pasi