[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
security gateways with different policies
hi!
i'm trying to understand how negotiation of SA granularity is supposed to
work.
suppose we have two security gateways with different policies in their
SPDs. first gateway has single rule which says that it must apply IPSec
processing to all packets and that SA selector is copied from SPD. second
gateway has single rule which says that it must apply IPSec processing and
that SA selector is copied from packet. first gateway wants to use single
SA for all traffic and second one wants to use different SA for every TCP
connection/UDP packet.
gateways use IKE for SA setup. how does the Quick Exchange look like when
the first gateway is initiator and when second gateway is initiator? what
are the IDui and IDur? can the responder change IDs sent by initiator or
not? when the second gateway is initiator and sends IDui, IDur which
specify single TCP connection, can the first gateway accept it even if
it's SPD wants to use single SA for all traffic?
arne