[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Misc. issues: Inbound SA triple identification / Inbound&Outbound SA, selectors exchange
> For an outbound SA, the destination address is actually the right key.
>
> For an inbound SA, the IP address wich allows us to uniquely identify an
> SA, along with the SPI and the protocol, is the SOURCE IP address. There
> is no reason why two remote peers would not allocate the same SPI. I'd
> say we even need to consider the source IP address of the cryptographic
> endpoint: in tunnel mode we need to know the IP address of the IPSEC
> tunnel endpoint in order to uniquely identify the SA for an incoming
> packet.
>
> Is this correct?
No. The receiver is responsible for allocating unique SPI values and
communicating them to the sender.
- Bill
Follow-Ups:
References: