RE: Re: Lack of packets from other end

On Tue, 2004-12-21 at 22:24, Bora Akyol wrote:
>  We may need some
> logic to do Make-before-break type switch like is common on cell phone
> networks.

that's the entire point of attaching sctp-like multiple addresses
to IKE and IPsec SA's.

anyhow, to respond to an earlier question of yours:

 - if the SG's peer has given us multiple addresses
 - and the SG is also a stateful firewall of some sort

then it should be capable of noticing that traffic to the peer
*should* have provoked a response (e.g., any non-pure-ACK TCP
segment) but *didn't*.

if the SG is not acting as a stateful firewall I wouldn't expect 
it to do this sort of thing.  decouple the source of the hints that 
all is not well from the action taken when you notice all is not 
well, and leave which hints to use open-ended for now..