Re: issues 18, 15, 6 -- return routability

Mohan Parthasarathy wrote:

>  > 
>  
>
>>  - Do the tests if configuration tells you to
>>  - Default is on
>>  - If the specific IP address can be found in the peer's certificate, 
>>you can skip the test
>>
>>    
>>
>I am okay with the first two. I must have missed the discussion on the
>address found in the peer's certificate.. What address ? Can you give
>some more details ?
>  
>
This is what the design draft said:

   o  The addresses a peer is using are part of a certificate.
      [RFC3554] introduced this approach.  If the other peer is, for
      example, a security gateway with a limited set of fixed IP
      addresses, then the security gateway may have a certificate with
      all the IP addresses in the certificate.

(But the use of certificates in this manner seemed to be a
bit controversial in the meeting, and this list discussion seems
to ask questions about it too. We might also consider the
certificate stuff as part of Vijay's "advanced configuration",
i.e., possible but implementation dependent behaviour.)

--Jari