Re: divergent interpretations of IKE/IPsec - interop issues

[Markku Savela <msa@burp.tkv.asdf.org>]

> The order of ESP and AH in the proposal
>     - Don't trust the order; although there is an order, it is actually
>       a set of proposals.
>     - Always send in order XYZ  (I prefer ESP followed by AH, some
>       otherwise).
>     - The semantic is always the same (ESP inside AH)
>     - If IPcomp involved, IPcomp, ESP, AH.

This and some other entries just show that IKE should not do
bundles. Creates unnecessary combinatory complexties.

It should negotiate a single SA at time (or to optimize, all
SA's, but it should not care about their order), it does not
matter. The policy checks in kernel will take care of bundle
requirements.