Re: straw poll on issue 20 (selection ipsec sa addresses andwho decides)

 In your previous mail you wrote:

   >   Option 3: "Initiator decides"
   > 
   I am assuming that this means that the initiator tests for bidirectional
   reachability and then tells the peer about the working address.
   One main reason why this seems favorable is because it works well
   with NATs and Firewalls. It does not mean that it does not work when
   they are not there. But may not work ideally e.g. two SGs connected
   and only one of them can decide. So, why build a protocol with
   this limitation ?  Does providing an option for either one of them to
   choose or both of them to choose complicate the protocol (perhaps
   there could be the ping-pong effect of each one changing back and
   forth if both of them can choose) ? For example, the initiator says that
   it wants to be the deciding factor. The responder knows that the initiator
   is not behind a NAT (by looking at NAT-D payloads), then it might be
   okay for the responder to choose also, right ? So, the responder can also
   choose to be the deciding factor in this case. 
   
   Though i *like* this option, it might make sense to provide some
   flexibility for this option.
   
=> you seem a candidate for option 5 (don't forget that RFC 3484 is
a predictable algorithm and List_B is likely to be known before
sending the first packet, and BTW how the addresses of this first
packet are chosen?).

Regards

[email protected]

PS: in my address set management framework, List_B is initialized by
the first packet destination address. In the common case the result
will be the same than option 3 but B has the capability to change
its address.