[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: Simplifying IKE
> I'd also like to see all IPSEC traffic between two hosts carried by just one
> SA. I can't see any value in using multiple SAs between to hosts. IPSEC
there is. and it's not related to security at all.
suppose you have slow internet connection that is used only for VPN
traffic. your access router has no way to distinguish between different
sessions inside your VPN so it will put all the packets into same queue.
if somebody is moving large file using ftp your telnet connection will be
very very slow.
without encryption the routers will put packets from separate sessions
(defined by src&dst IP, protocol and ports) into seprate queues (cisco
calls them classes IIRC) and even if you are downloading some huge file
your telnet session is still usable.
with encryption the SPI is the only parameter that can be used to classify
the packets. if you are using a single SA between two hosts it's
impossible for routers to distinguish between packets from different
sessions and the interactive applications suffer really bad.
arne
Follow-Ups:
References: