Re: [Q] SA lookup on receive

[Stephen Kent <kent@po1.bbn.com>]

Abraham,

>When an ipsec packet is received, an SA is looked up using the
>tuple <dest-ip,spi,protocol>. Must the dest-ip be a local ip
>address of the security gateway? What if the dest-ip address is
>the address of an internal host?

Any SA involving a security gateway MUST be a tunnel mode SA, so the outer
IP address will be that of the gateway, not of the internal (ultimate
destination) host.  The latter address will be in the inner IP header.

Steve

---

Follow-Ups:

• Re: [Q] SA lookup on receive
• From: Abraham R Matthews <amatthews@cosinecom.com>

References:

• [Q] SA lookup on receive
• From: Abraham R Matthews <amatthews@cosinecom.com>

---

• Prev by Date: I-D ACTION:draft-ietf-ipsec-ipsec-doi-09.txt
• Next by Date: Re: Latest AH/ESP/Arch drafts and changes
• Prev by thread: [Q] SA lookup on receive
• Next by thread: Re: [Q] SA lookup on receive
• Index(es):
  • Main
  • Thread