[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: addresses and IKEv2

 In your previous mail you wrote:

   Bleah. Ignore my previous brain fart. As far as
   IPsec (2401) is concerned the *source* of the
   outer tunnel IP header is irrelevant, which is
   primarily what mobile/multihomed things want.
   
=> unfortunately many implementations still check the outer source
because this is not explicitely forbidden. Revision of 2401 and
interop tests should clarify this point (IKEv2/ESPv3 were a big step forward
because they make clear that inbound SA selectors are traffic selectors).

Thanks

Francis.Dupont@enst-bretagne.fr