[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: inbound Spd lookup for IPsec packets.
Amal,
If we fail to check the inbound packet header against the selectors after
IPsec processing, then anyone who is authorized to connect to an IPsec site
can masquerade as any other connected user, and they can send traffic not
authorized by the negotiation carried out by IKE. This can happen for both
transport and tunel mode SAs, although it it potentially more serious for
the latter as there are more opportunities to devite from the SA profile.
Steve
Follow-Ups:
References: