Re: Specification of tunnel/transport attribute in IKEv2

[Markku Savela <msa@burp.tkv.asdf.org>]

> On Sat, 11 May 2002, Markku Savela wrote:
> > If IKE negotiated only keys, these ordering issues would never have
> > surfaced.
> 
> On the contrary:  they would have surfaced, in whatever other protocol
> was devised to handle the policy checking.
> 
> Simply removing these issues from IKE does not make them go away.

There is no need for such other protocol. Assuming your implementation
is conformant to RFC-2401, it already does the policy checking,
whether IKE is present or not.

The issue of how the policies are installed to the hosts, is totally
different matter.