[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Daemon Recovery
>It's worth having the functionality but it's not required to have
>two different messages. Use the DOI already present in the notify
>message to define the scope of what SA's should be nuked. If the
>system rebooted and lost all SA's, send two notify's -- one for the
>ISAKMP DOI and one for the Internet DOI.
Ah, I see the confusion. There isn't a separate DOI for ISAKMP. You say
that the message is directed at an ISAKMP SA if the message ID field (back
in the generic ISAKMP header) is zero.
I'm going to leave it a single message for now, with the assumption being
that this is being sent because the host rebooted and lost all state.
That's the problem we're most concerned with.
Derrell
Follow-Ups:
References: