Re: question on Matching SAD and Selectors

["Aaron Griggs" <agriggs@east.isi.edu>]

> >Does this mean inbound SPD not used by inbound traffic at least before IP
> >processing?
>

For Outbound traffic, you must look at the Outbound SPD to find the
appropriate IPSec to do.  For inbound traffic, the sender found the IPSec so
you just look at the up the Triple (SPI, Dest IP, IPSec proto) to
authenticate and/or decrypt the packet.  This is at the IP layer but before
the transport layer.  At the transport layer, you look up the Inbound SPD to
make sure the proper IPSec was performed for this traffic.

Hope this helps,

Aaron

---

References:

• Re: question on Matching SAD and Selectors
• From: Stephen Kent <kent@bbn.com>

---

• Prev by Date: RE: IP Authentication Header implementation
• Next by Date: Re: question on Inbound / Outbound SAD/SPD RFC2401
• Prev by thread: Re: question on Inbound / Outbound SAD/SPD RFC2401
• Next by thread: IP Authentication Header implementation
• Index(es):
  • Main
  • Thread