RE: RE: issue 34 -- ESP vs. IKE based NAT reboot detection

OK.  Sounds like we are in agreement.

If a host suspects that his peer is dead (or the path is dead), then he
sends a DPD/mobike probe.

It's worth noting that a host MAY use the arrival of a packet which
seems to have wrong IP or port (due to possible NAT mapping change) to
trigger this process.  This IMO, is the best of both worlds.

Stephane.
 

> -----Original Message-----
> From: Tero Kivinen [mailto:[email protected]] 
> Sent: Friday, September 02, 2005 3:50 AM
> To: Stephane Beaulieu (stephane)
> Cc: Jari Arkko; [email protected]; Mohan Parthasarathy; 
> [email protected]
> Subject: RE: [Mobike] RE: issue 34 -- ESP vs. IKE based NAT 
> reboot detection
> 
> Stephane Beaulieu \(stephane\) writes:
> > DPD's are only sent *if* one suspects that the peer is no longer 
> > receiving pkts.  What we've seen in the real world is that 
> in a span 
> > of
> 
> Actually no, it is sent if you suspect the other peer is 
> dead, and you might suspect it being dead because multiple 
> reasons. One reason is the lack of packets from the other 
> end. Another reason might be the ICMP message or some other 
> indication from the network.
> 
> So if you suspect the other peer is dead, you test it with DPD packet.
> This handling is identical with normal IKEv2, and NAT-T, and 
> both alternative 1 and 3.
> 
> The only difference is that in alternative 3 you notice NAT 
> box booting (or NAT mapping disappearing) by the lack of 
> packets from the other end. I.e. you notice that you are not 
> getting any responses back thus you start DPD as normally, 
> and with this DPD you also request the other end to make sure 
> that the IP address and port number the other peer is using 
> matches the ones in the NAT mapping.
> 
> > a 24 hour VPN RA connection, you'll probably only see about 
> 20-100 DPD 
> > messages (which are usually clustered in groups during high 
> web-usage 
> > times).
> 
> If there is traffic going on in both directions then you do 
> not ever see DPD packets. You only see DPD packets when you 
> do not receive packets from the other end (either it being 
> dead or it being idle). 
> 
> > So, DPDs are not periodic.
> 
> True, the original description was misleading because of that.
> 
> > Having said that, I don't see why probes would need to be periodic 
> > either.  If you suspect the pkts aren't getting to your peer, then 
> > send the DPD/mobike probe.  Otherwise, don't send anything. 
>  If we can 
> > agree on this, then I'm OK with probes.
> 
> This is the case with alternative 3. I.e. they are not 
> periodic, they are only sent when the host behind NAT 
> (initiator) detects that it is not receiving anything from 
> the other end (perhaps because the NAT reboot or something), 
> and that DPD will then also be used to fix the NAT mapping in 
> the other peer (i.e. do the similar update that alternative 1 
> does for all packets, here we simply explicitly request the 
> other end to fix the situation).
> --
> [email protected]
>