[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: AH (without ESP) on a secure gateway
> So, irrespective of the other points argued by contributors to this
> debate, the fundamental problem here is the potential conflict between end
> systems and intermediate system use of the same header and SPIs.
But this potential conflict is not necessarily fatal, is it? Assuming
cooperating firewalls, the conflict can exist and be irrelevant. The
firewalls unwrap outer headers according to their notions of the SA
mappings, and the end hosts unwrap inner headers according to their
notions. Conflicts are invisible as long as the firewalls are in place.
BTW, does anyone run multiple firewalls and try to keep the databases
in synch?
Hilarie
Follow-Ups: