[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: Re[2]: ISAKMP commit and notify usage
>This is the conclusion I came to when implementing the commit bit.
>For phase 1 I check for exchange type, if its not Aggressive I'll signal
>Invalid flag if the commit bit is set. It didn't seem to make much
>sense for Main Mode.
>----
I do not see anything in the ISAKMP spec which limits the use of the commit
bit to the agressive mode. Granted this may have been the driving reason
for the commit.
I would like to allow the general use of the commit bit by initiator or
responder in any mode. This allows support for security policies and
implementations (e.g. multicast) which may require ISAKMP to access another
machine prior to allowing encrypted traffic to flow.
Tom Markham markham@securecomputing.com
Secure Computing Corporation Phone (612) 628-2754
2675 Long Lake Road Fax: (612) 628-2701
Roseville, MN 55113 www.securecomputing.com
Follow-Ups: