Re: RE: issue 34 -- ESP vs. IKE based NAT reboot detection

Mohan Parthasarathy writes:
> Ok. Again, i am not sure whether the reason it does not exist in
> hardware today is because there is a lack of need for it or it is
> difficult to do it in hardware ?

Mostly because it has not been needed before this. And we are now
talking about the IPsec hardware, not just basic crypto hardware.

There is two issues there.

Firstly you need to be able to do the actual update of the outer
tunnel address. I think none of the hardware drivers support APIs for
doing that, and I am not sure if any of the actual hardware support
that. You can probably do it by reading information from old SA,
removing the old SA and install new SA, with new outer address, but
with same SPI, keys, window and sequence number. The problem there is
that hardware might not give ability to read the window and sequence
number from inside the chip.

That feature is needed for mobike anyways, so we need to find solution
for that (might require new hardware, but hopefully hardware driver
updating is enough (depending on the hardware limitations)).

The second case is to get the notifications from the hardware when the
outer IP-numbers do not match the ones configured to the SA. This is
case that is only needed for the NAT-T dynamic updates. I am doubtful
that any current hardware supports that, and I haven't really found
out suitable workaround to be able to emulate that on hardware. It
might require software check for each packet, which might destroy the
hardware speedups... 

> As VPN gateway most likely will use hardware acceleration and as
> this feature does not seem to be present in the hardware, would it
> not make sense to use alt.3 ?

Thats why I am saying alternate 3 is better, as it requires less
changes or updates to the hardware.
-- 
[email protected]