| Newsgroups |
gmane.ietf.mobike |
| Message-ID |
<[email protected]> |
Hi,
Perhaps my presentation was a bit unclear on this, but MOPO-IKE does
not use ICMP (which would not really work, due to the reasons you
mentioned). Instead, it adds a new message type to IKEv2 (somewhat
similar to the IKEv1 R-U-THERE/R-U-THERE-ACK messages).
Best regards,
Pasi
> -----Original Message-----
> From: Eric Vyncke
> Sent: Tuesday, March 08, 2005 3:17 PM
> To: [email protected]
> Subject: [Mobike] MOPO and the 'ping' probes
>
>
> As Paul asked for new voices during yesterday meeting... ;-)
>
> I just wonder using 'ping' to test the reachability of a peer
> is correct.
>
> Pings will give a good indication in 95% of the use cases,
> but, due to ICMP rate limiting (to prevent DoS), due some
> security policy (denying ICMP or IPsec over UDP), ... there
> will be a disconnect in a couple of use cases between a ping
> exchange and an IKEv2 exchange.
>
> In some cases, ping will go back and forth the peers while
> IKEv2 won't.
>
> In some other cases, ping will not go back and forth the
> peers while IKEv2 will.
>
> In short, use out-of-IKE probes only as a very rough estimate.
>
> Hope this helps
>
> -eric