[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Increased sequence number in ESP/AH
> While we're on the subject of sequence numbers and IKE negotiation
> I'd like to make use of them negotiable. Right now the sender must always
> send them even if the recipient is not using them. Parallelization of
> IPsec processing is much easier if both sides can agree to forgo the
> benefits of the anti-replay check.
If all you care about is performance, it's even faster if you leave
out the crypto. :-)
If you want to avoid multiple crypto engines single-threading on the
counter increment, negotiate multiple equivalent SA's and load-balance
across the SA's..
- Bill
Follow-Ups:
References: