RE: RE: issue 34 -- ESP vs. IKE based NAT reboot detection

--- Tero Kivinen <[email protected]> wrote:

> [email protected] writes:
> > Actually, we need a separate PATH_TEST message
> even with the explicit
> > update if we want to be able to do path testing at
> any time without
> > the possibility of disrupting things.
> 
> You mean the case, where we have decided to move to
> new address, but
> that new address breaks down after us testing it and
> after we sent
> update to it, but before we get reply back to it? I
> think we do not
> disrupt things more even if we use the IKE SA update
> message for
> testing the path. The path is already broken, so we
> cannot disrupt it
> more. After we get the IKE SA update message
> through, we have then
> already fixed the situation, with separate path test
> we still need to
> wait one more extra round trip to fix the situation
> (i.e we first use
> the PATH_TEST to find the working path, and then
> send the packet to
> that address, compared to using the IKE SA update
> message to do the
> path test, and that will immediately fix the
> situation when the
> correct path is found (or in case of unidirectional
> paths, then we
> need to wait the another round trip, i.e. for the
> second address
> update to reach the host)). 

The only time this won't work is when the window is
already closed. In that case, you retransmit with new
address and then on getting a response, send an IKE
message with the UPDATE_SA_ADDRESS payload. This is
the same as sending PATH_TEST message and then use the
results of PATH_TEST message for sending the IKE
message.

-mohan

> -- 
> [email protected]
> _______________________________________________
> Mobike mailing list
> [email protected]
> https://www.machshav.com/mailman/listinfo.cgi/mobike
>