Jari Arkko wrote:
> Hi Mohan, and thanks a lot for your comments!
>
> Pasi, can you register this as an issue? Or break down per
> section, Mohan's issues are quite separate below.
I'm breaking this to a couple of issues...
> Inline:
>
> >A few comments/questions...
> >
> > - Section 4.4
> >
> > The initiator receives a NAT_DETECTION_DESTINATION_IP
> > notification that does not match the previous
> > UPDATE_SA_ADDRESSES response (see Section 4.7 for a more
> > detailed description).
> >
> > This does not work reliably when IKE rekeying happens which
> > changes the IKE SPIs. The initiator is behind NAT, creates
> > the IKE SA and notes the down the
> > NAT_DETECTION_DESTINATION_IP notification value (hash of SPI,
> > IP address and port). If rekeying happens sometime later but
> > never received a NAT_DETECTION_DESTINATION_IP or received one
> > before rekeying happened, then the hash may differ because
> > the NAT rebooted causing ports to change OR SPIs changed
> > because of rekeying. How do you tell the difference between
> > the two ? According to section 4.7, the sender SHOULD send
> > UPDATE_SA message. Though there is no harm in sending one,
> > this case should be explained somewhere..
>
> I think you are correct. I agree though that this does not cause
> a serious problem.
Hm... yes, this is true. Any suggestions what to do about this?
Would just mentioning this be sufficient? (It doesn't seem
to be a serious problem, especially since IKE_SA rekeying is
not done very frequently.)
Best regards,
Pasi
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.