[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Son-of-IKE Performance
> The problem is that if the first encrypted packet arrives before the
> responder establishes the SA then the packet will be dropped.
Not necessarily.
Before the sender can send anything on the SA, the receiver needs to
have allocated the SPI that the sender will use.
The receiver can thus buffer encrypted packets in a "larval" SA until
the keying material arrives.
Naturally, you need to apply reasonable limits for how much and how
long you're willing to buffer, but this is going to be very similar to
the buffering typically done while waiting for arp replies..
- Bill
Follow-Ups:
References: