[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: an inbound SPD-check question
Stephen,
>Say I am processing an inbound packet that has IPSEC protection. I have
>located the
>right SA and I have decoded the original packet.
>
>I am then required to check the SPD to see that the require security was
>applied for the
>packet I now have. If the SPD check comes back with the answer "BYPASS"
>(i.e. no
>security required), do I dump the packet, or forward it?
>
>A bit of silly case (probably some mis-config somewhere), but it could
>happen. If security
>has been successfully applied, it seems a bit naff to bin the packet because
>the inbound SPD
>check says the IPSEC protection was not required.
I'd drop the packet and make an audit log entry. We want misconfigurations
to be detected and the SPD changed and if we don't provide feedback ...
Steve
Follow-Ups:
References: