Re: issue 39 (was: comments on draft-ietf-mobike-protocol-01.txt)

Hello again,

On Wed, 31 Aug 2005 16:06:31 +0300
<[email protected]> wrote:

> Shinta Sugimoto writes:
> > 
> > Hello,
> > 
> > I read draft-ietf-mobike-protocol-01.txt and had following
> > comments/questions.
> > 
> > Technical Comments/Questions:
> > 
> > - Section 2.3 (Changing addresses in IPsec SAs) I need
> > clarification on how address change functions in MOBIKE. First
> > of all, does UPDATE_SA_ADDRESSES take effect on more than one
> > address changes ?  Or it's supposed to update a single address? 
> 
> It updates the one source and one destination address in
> IKE and IPsec SAs (the src/dst addresss that is currently
> used for outgoing packets).

OK.

> > Probably I am confusing the purpose of UPDATE_SA_ADDRESSES
> > and ADDITIONAL_*_ADDRESS.  In my understanding,
> > UPDATE_SA_ADDRESSES is for updating the preferred address,
> > which means that IKE_SA and IPsec SA (only matched one) are
> > the target of the address update. OTOH, ADDITIONAL_*_ADDRESS
> > is for updating (requesting its peer to update) the peer
> > address set.  Do I get it right?
> 
> Yes, I think you got it right (although the protocol document
> does not currently use the term "peer address set"). This set is
> used as input for address pair selection (on initiator side),
> and possibly when responder address changes (although the
> details need some clarification here...)

OK.
 
> > One more question: Should the initiator make all the CHILD_SAs
> > inactive which are associated with the IKE_SA whose "pending_update"
> > flag is set ?
> 
> Why should it? (Continuing using those CHILD_SAs should work
> just fine, since in 2401bis the responder uses only the SPI for
> locating the inbound IPsec SA.)

I see. I came to understand that there should be no problem with
initiator sending/receiving packets with new address right after
the address change.  I need to synchronize my mind with RFC2401bis...
Thank you for the clarification.


Regards,
Shinta