RE: Is TS agreement necessary?

["Rajesh Mohan" <Rajesh.Mohan@nexsi.com>]

> 
> we designed IPsec to not have to trust peers to do the right thing. 
> we adopted a defensive posture consistent with the security principle 
> of least privilege.  I'm not sure how to interpret your comments 
> relative to this well known security principle.
> 

I think we are imposing the trust model on the end users here. It should be configurable. If the administrators chooses to trust the peer, then there should be a way to configure it.

If we do not allow, people will workaround it. For example, if it is required, people will do IP in IP with the gateways as selectors.


-Rajesh M