Re: MOPO and the 'ping' probes
Jari Arkko <[email protected]>
| Newsgroups | gmane.ietf.mobike |
|---|---|
| Message-ID | <[email protected]> |
Right, and this would indeed be an issue. But I think Pasi's intent was to use a new IKEv2 message instead of ICMP. He just referred to the message as a 'ping'. His proposed message was indeed outside the normal IKE processing, but only with regards to the window, not in terms of going outside UDP and port 500, or the IKEv2 message structure... --Jari Eric Vyncke wrote: >As Paul asked for new voices during yesterday meeting... ;-) > >I just wonder using 'ping' to test the reachability of a peer is correct. > >Pings will give a good indication in 95% of the use cases, but, due to ICMP rate limiting (to prevent DoS), due some security policy (denying ICMP or IPsec over UDP), ... there will be a disconnect in a couple of use cases between a ping exchange and an IKEv2 exchange. > >In some cases, ping will go back and forth the peers while IKEv2 won't. > >In some other cases, ping will not go back and forth the peers while IKEv2 will. > >In short, use out-of-IKE probes only as a very rough estimate. > >Hope this helps > >-eric >_______________________________________________ >Mobike mailing list >[email protected] >https://www.machshav.com/mailman/listinfo.cgi/mobike > > > >