[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Auto filter rule generation for Phase 2 tunnels
Vach,
This question si addressed in the IPsec security architectrure
document, a revised verison of which has just been posted as an I-D. The
solution proposed there (as in the prevuious version distributed on
7/30/97) is that the set of security policy rules (filters) MUST be
ordered. As you note, there is no obvious canonical ordering, especially
when one adds the other selector types defined in the architecture
document. It is important that both ends know what traffic is being
matched to which rules, since there is also a desire to check the source
address(and maybe other selector info) upon receipt, to prevent spoofing
after SA establishment.
Steve
Follow-Ups:
References: