[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: proposed changes to ISAKMP/Oakley
Harald,
>> I would agree that this should be mandatory. If constraints (like proxy ids)
>> are given during negotiation they must be respected by all parties to the
>> negotiation. Any other WG members have an opinion either way?
>
>What about when they are *not* given? Many people seem to be refusing all
>non-local packets in that case. It would be nice if people's policy engines
>would simply allow all traffic between two routers to be protected without
>negotiating specific proxy-IDs. This is (once again :-) the concept of
>treating a tunnel as a logical, point-to-point link between two gateways.
The arch doc draft required that traffic be mapped to SAs based on
"selectors" and my suggestion is that all traffic emerging from an SA ought
to be checked against the set of selectors specified when the SA was
created. This should apply to manually keyed SAs as well as ISAKMP SAs.
I'm less comfortable with the use of the term "proxy ID" as per ISAKMP, as
it is specific to that key management method.
Steve
Follow-Ups:
References: