Re: road warrior and id field.

Kaustubh Kumbhalkar writes:
 > anyways , then the point is that the responder should respond to the
 > initiators 'source address' and not the address as specified by IDii.

Correct.

 > in freeswan when we initiate a connection from the road warrior , the
 > responder updates its connection information with the 'source addresss' of
 > the road warrior.
 > while the security association is required to be made w.r.t the address
 > specified by IDii.
 > if this is possible then ,this wil allow a road warrior to negotiate SA's
 > for its home address (using IDii) while having foreign address as the
 > source address for its IKE packets.
 > anything wrong in  this?

It is correct that IDii will be used by the responder to decide
whether to complete the SA creation or not.  I'm not entirely
comfortable with the wording "to negotiate SA's for its home address"
since I read it as implying that the SA is between the initiators home
address and the responder.  That's not the case, the ISAKMP SA is
between the initiators actual (not home) IP address and the responder.
The initiators home IP address in this scenario is just being used as
a identifier to determine if the SA should be set up, it is not being
used for routing packets.  Since your example was using authentication
via signatures one could just as well send a ID_FQDN or ID_USER_FQDN
instead of an ID_IPV4_ADDR.  Any of them would result in
authentication succeeding (assuming the responder accepts the values)
and none of them imply the SA is in any way connected to initiators
home IP address.