Re: IKEv2 and multiple tunnels. (Was: QoS and IKEv2)

[Uri Blumenthal <uri@bell-labs.com>]

Jesse Alpert wrote:
>>SPI itself is already "uniquifier". Maybe the problem is not here, but
>>instead in the definition of what is "redundant"?
> 
> You are right, and that will probably work as well.

Then why multiply the entities? Occham's Razor...


> However:
> If I understood correctly, IKEv2 draft was referring to the case where both
> peers initiate a CHILD-SA exchange almost at once, resulting in two
> identical IPsec SAs one of which IS redundant. In such a case you would want
> to close one of the SAs to save on resources. The "uniquifier" can be used
> to indicate this is not the case.

I don't think it would work the way you describe - i.e. both
hosts are unaware and so created SAs with "uniquifier" 0...

I don't know how to deal with the described problem efficiently.