Re: NAT Traversal

["Chinna N.R. Pellacuru" <pcn@cisco.com>]

On Mon, 4 Mar 2002, Bill Sommerfeld wrote:

> "responder SPI as a hash of the initiator's SPI"?
>
> Which initiator? phase 1 initiator?  phase 2 initiator?
>
> When a rekey occurs, the initiator and responder roles can be swapped.
>

Yes, good point. We are referring to the phase2 initiator.

The NAT device need not know which SPI is the initiator SPI and which one
is the responder SPI though. When a NAT device has a pair of SPIs that it
needs to see whether they belong to a pair, it has to see for the relation
both ways. So, if we have SPI1 and SPI2, the NAT box will try to see if
the hash of SPI1 is equal to the half of SPI2, or the hash of SPI2 is
equal to the half of SPI1. Both of these result in a match.

    chinna