[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: issues with IKE that need resolution
Question to IPsec implementors:
What is the "proper" behaviour of the IPsec implementation upon receiving an
IPsec-transformed packet for which there is no IPsec SA, but there is an SPD
entry and/or IKE SA for the IP address of the sender (or the associated IP
Range or IP Subnet)? I couldn't find anything in the standards on this.
- Should the packet be discarded?
- Should it trigger MM (or QM) initiation? - may be good for some recovery
cases , but bad for denial-of-service or other attacks.
- Should the sending end be notified?
I think this is an important interoperability issue.
.
--
Bronislav Kavsan
IRE Secure Solutions, Inc.
100 Conifer Hill Drive Suite 513
Danvers, MA 01923
voice: 978-739-2384
http://www.ire.com
Follow-Ups:
References: