Re: Move TS to optional (RE: Don't remove TS from IKEv2)

[Paul Koning <pkoning@equallogic.com>]

Excerpt of message (sent 2 April 2002) by Mike Ditto:
> Dan Harkins <dharkins@tibernian.com> wrote:
>  > All I'm saying is that if a certain set of selectors manually configured on
>  > one end corresponds to whatever it is you manually do on your end then there
>  > is a mapping between a set of IPsec selectors, and therefore an equivalent
>  > set of TS payloads, and whatever your configuration looks like.
> 
> But the two ends' configurations DON'T correspond to each other.  Each
> end has a policy that describes a superset of the traffic that will
> actually be sent.  Probably both ends have defined a policy that uses
> the smallest superset that their respective policy notations allow. 

That's not enough.

Implementing a policy, in the case of IPsec at least, means (a)
accepting traffic that matches the rule, and also (b) rejecting ALL
traffic that does not match the rule.

So "a superset" is not a valid substitute for an exact match.

      paul