[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: TCP checksum recalculation
Hello,
At 12:28 20.07.99 -0400, Robert Moskowitz wrote:
>Oh with MIKE, consider that at each IKE SA boundary, the addresses are
>altered at each point (shades of RSIP), so then TCP checksum would really
>be broken and partial recalculation would be different (not just TTL, but
>whole IP).
MIKE is a kind of "application-level gateway", and from the transport view the messages are exchanged in unsecured UDP packets between MIKE instances in the same IP realm (if these instances are at the border of a realm; otherwise - NAT between two MIKE daemons - raises the same (minor) issues like IKE over NAT).
Hmm, I didn't really watch the RSIP developments, but there could be other advantages for RSIP servers to know about the relation of
{dst, SPI, ESP} <-> {src, dst, s-port, d-port}....
In draft-ietf-nat-rsip-ipsec-00.txt, RSIP servers utilize SPIs to demultiplex incoming traffic, but they need to *negotiate* a SPI with the client, which it finally uses end-2-end. This MIKE doesn't provide (yet?).
Kai
References: