Re: Is TS agreement necessary?

[Joe Touch <touch@ISI.EDU>]

Wang, Cliff wrote:
> I don't understand the recursive part from both implementation and standards
> point.

It's recursive as in 'self referential', not as in 'packets loop'. 
Perhaps self-referential would have been more precise.

The point is that RFC2401 talks about tunnel SAs being in the SPD of the 
interface over which the tunneled packets go, not the tunnel itself. 
I.e., putting the SA in an SPD of a tunnel which exists only because the 
SA says "please encapsulate these packets" uses an SA that refers to the 
tunnel (i.e., self-referential).

> The SPD is used to decide what should go into the tunnel, normally a clear
> packet, not an IPsec packet.

Ihe SPD decides only whether a packet already sent to the tunnel by 
routing is tunneled and IPsec'd; having an SPD on a tunnel deciding what 
gets tunneled is the self-referential part.

Joe