Re: IKEv2: prepending four octets

[Tero Kivinen <kivinen@ssh.fi>]

ravivsn@roc.co.in (Ravi) writes:
> So, we will not disturb these NAT devices to work on port 500
> Since, IKEv2 is now building from scratch we shall standardise Port 4500 
> instead  of 500.The non Zero in first
>  four bytes indicates IPsec packets and Zeros indicate IKE packets.

The problem with that is that it causes long timeout during the
transition period, i.e if initiator supports both IKEv1 and IKEv2, it
would start with IKEv2 to port 4500. The responder which only supports
IKEv1, would not even see those packets, and the initiator would have
to wait for the timeout (tens of seconds or even few minutes?) before
falling back to IKEv1 and port 500.

If the initiator starts with port 500 (with IKEv2 protocol) then the
IKEv1 implement will see the packet, and hopefully it will send back
notification INVALID-MAJOR-VERSION. There will be implementations out
there that will not send that notification back, but for those who did
this properly and will send the notification, can get rid of the extra
timeout. 
-- 
kivinen@ssh.fi
SSH Communications Security                  http://www.ssh.fi/
SSH IPSEC Toolkit                            http://www.ssh.fi/ipsec/