[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

issue with "per-interface SAD/SPD"

The RFC 2401 mandates (section 4.4, page 13) separate inbound and
outbound databases (SAD and SPD) for each IPsec-enabled interface.
This doesn't work in a dynamic environment where for instance dynamic
routing makes the arrival of a packet for an address of a node possible
on more than one interface in a long term, or where the peer is a mobile
The problem exists at least in SAD lookup for incoming traffic and for
SPD matching in IKE... IMHO the simplest (so the best :-) solution is
to introduce an interface selector: the "firewall" properties are kept
but a SPD entry can be "shared" between some interfaces.
How this will be handled in the revision of RFC 2401?