[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: NAT Traversal



At 3:52 PM -0800 3/4/02, Chinna N.R. Pellacuru wrote:
>Hi Steve,
>
>Is it possible that along with the sequence number, we also increase the
>SPI space so that we can use some of the SPI space for NAT translation.
>We could keep the original restrictions on how to pick an SA, or we need
>to come up with elaborate schemes to effectively increase the SPI space,
>like you are attempting to increase the sequence number.

I see a problem here. We increased the sequence number size, but 
didn't transmit the extra (high order) 32 bits!  So, I can't see 
folks being fond of an increase in SPI size.  It is no accident that 
the current ESP header is a multiple of both 4 and 8 bytes, using the 
default integrity algorithm length, specifically to ensure IPv4 and 
v6 alignment for the payload. Adding 2 bytes for a bigger SPI would 
break that alignment.

>How does the transition happen? If the new ESP ID is placing additional
>restrictions that did not exist originally I think it is fair to ask the
>new ID to accomidate NAT traversal by increasing the SPI space. It's like
>shutting off all the doors for us.

The extended sequence number is an option that is negotiated by IKE 
(or its successor), so it is backward compatible with existing 
implementations that do not support the extended sequence number 
facility.

>
>You bring up another good point about multicast. Frankly, I haven't
>thought about it. I'll have to look at this and get back to you and the
>list.

OK.

Steve