[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: use of client IDs
Scott,
> Policy is a local matter. Gateways with differing policies may or may
> not communicate, depending upon the intersection of their policy sets.
Agreed. What I want to make sure of is that two boxes that claim IPSEC
conformance are not fundamentally uninteroperable if a security gateway
is serving multiple disjoint subnets. Either the transmitting gateway
must be able to set up multiple SAs to the same peer, one for each
subnet,
or a receiving gateway must be precluded from assuming that the source
IP
address of packets received on an SA will always either fall under the
range of the client ID if included, or the ID of the ISAKMP peer, if
not.
Bryan Gleeson
Shasta Networks.