Re: Re: bidding down attach on NAT-T

[Jayant Shukla <jshukla@earthlink.net>]

-------Original Message-------
From: Michael Richardson <mcr@sandelman.ottawa.on.ca>
    Charlie> there is nothing we could possibly do within IKE or ESP to
    Charlie> improve the situation.

  The thing that we could do, is require some kind of three way handshake
to
change the UDP port #/IP address. That could be a rekey.

  
We had this discussion a few days ago. This is the exact method we are using in our NAT traversal. However, this method too is not perfect as an attacker can falsly convince you to keep doing three-way handshakes. Not a big problem, and can be solved by rate limiting the three-way handshakes, but an annoynace none the less.

Regards,
Jayant
www.trlokom.com