Re: When to do Return Routability Checks

Francis Dupont wrote:
>  In your previous mail you wrote:
> 
>    Yes. For the do it all, I think the answer depends on configured policy,
>    with default being yes. For the when part, I think it should be done
>    prior to moving the SA and the data stream towards that address.
>    
> => we need more flexibility about moving the SA: to wait the RR check
> result is fine only when the previous peer address is still usable.

Yes. Or to be more precise, if you are still using the previous address
you can delay the check; but if you move the traffic stream to the
new address then you should do the check first. (All assuming the
check was configured ON in the first place.)

And as you wrote in another e-mail, a peer address that appears in
a cert or one that was just used one minute ago is already authorized.

--Jari