[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Protection of port 500
On Mon, Jan 15, 2001 at 12:44:06PM -0800, Pervaiz Rizvi wrote:
> Do you mean IPsec implementations silently
> ignore the configured policy to protect
> udp/500 with IPsec?
No, I meant precisely what I said.
As you seem to be already aware, you can't exactly use ESP to protect
IKE transactions because IKE is used to exchange keys for ESP. Therefore,
the IKE daemon needs to override the system-wide policy for the sockets
it creates and use some other mechanism to protect its transactions.
--
-- Jason R. Thorpe <thorpej@zembu.com>
References: