Re: NAT Traversal

[Bill Sommerfeld <sommerfeld@east.sun.com>]

> I am suggesting that the original concept of IPsec SA being identified by
> a tuple: destination IP, protocol, SPI be required, and within the SPI add
> new semantics for picking a SPI on the phase2 responder.

I strongly object.

UDP encapsulation works JUST FINE to get through NATs which aren't
trying to be too clever (and it appears that there are other
workarounds to deal with overly-clever NATs).

There's no need to introduce potential vulnerabilities/points of
collision/etc. elsewhere in the system.

						- Bill