[email protected] wrote:
> In your previous mail you wrote:
>
> Yes, I certainly agree that we should not assume this. I
> brought this up because at some point, Francis was suggesting
> that each end should be responsible for only changing its own
> address (e.g. 2004-07-29), but probably I misunderstood him here.
>
> => perhaps a SHOULD is a bit too strong here, IMHO this is only the
> common/likely case. There is a known exception: when the addresses
> are paired, it is better to change both addresses.
> I have two arguments in favor of my opinion:
> - a node has a better control on the condition of its own addresses
> - when an address becomes unusable, the only critical thing is to
> change the local address of *inbound* SAs.
Yes, certainly a node is likely to know better its own conditions
than the other node. But I don't quite understand the last point:
in 2401bis, inbound IPsec SAs don't seem to have the local (tunnel
header) address at all? (unless they're multicast, but that's beyond
IKEv2)
Best regards,
Pasi
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.