RE: Protocol and port fields in selectors

[sakari.poussa@nokia.com]

sakari.poussa@nokia.com wrote:
>> That is actually the whole idea; to reduce the number of SAs. Since
>> we are talking about several hundred thousands of SAs,
>> cutting the size
>> in half reduces the memory requirements (a lot) and improves
>> performance.
>

andrew.krywaniuk@alcatel.com wrote:
>This is essentially the argument against port and protocol based SAs in
>general. If you just used a firewall rule to block stray packets you
>wouldn't have this problem. Trying to reduce the memory footprint after
>mandating port-constrained SAs is like optimizing bubble sort.

I agree. But the way the 3GPP/IMS has specified the SIP IPSec protection,
we need to use the port numbers in the SAs. That is, some traffic
will be sent in clear (unprotected port) while other traffic is
IPSec protected (protected port). Too bad ;(

>Andrew

-sakari