[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: ipsec error codes
<... snip>
> I'd like some input on this before attempting to write up something more
> substantial. Are there additional requirements? Are the ones specified
> here correct?
>
> Scott
>
Here is my thinking on this.
When a packet is dropped at any node across the network due to
enforcement of a certain policy, it would be beneficial for the
end-node (that originated the packet) to know the policy that
caused the packets to drop and why.
Standardization of reject notification for such a purpose is
desirable. Such a message should not only contain the packet that
failed a policy, but also the policy and the ID of the policy
enforcement device.
It is important for the end-node to know if a packet is dropped
due to enforcement of a policy or due to congestion and random
drop. In the former case, it is fruitless to retry. If the
application were to be aware of the policy that failed the
session it could potentially pursue alternate approaches.
cheers,
suresh
Follow-Ups:
References: