Re: IPsec inbound processing

[Stephen Kent <kent@bbn.com>]

At 1:57 PM +0500 2/20/02, 827 wrote:
>The RFC 2401's section 5.2.1 says about selecting an SA / SA bundle for
>Inbound IP traffic. I am at the moment quite confused about the sequence of
>searching and using an SA.
>
>Why is it so that we first directly look for an SA from SAD using the
>selector valus of the packet? Why not we directly refer to SPD than get the
>SA pointer from there (SPD) to look it in SAD.
>
>And if it is not the way i have written it, how an inbound ip packet is
>processed?
>
>Regards.
>
>Siddique
>FAST - NU Pakistan

Siddique,

We are in the process of revising 2401, after we finish with ESP and 
AH.  In the revision we will include a new processing model that 
clarifies what has to be done and which will eliminate the discussion 
of searching the SPD.  The wording used in this part of 2401 has 
caused considerable confusion over time and I apologize for that.

Steve