RE: SAs that carry fragments Was: Re: Some IKEv2 issues

[Stephen Kent <kent@bbn.com>]

At 23:46 +0200 2/20/04, Tero Kivinen wrote:
>Stephen Kent writes:
>>  We've had analogous debates on this before.  IPsec is NOT just a VPN
>>  technology and our specs ought not be VPN-specific. I have certainly
>>  advised folks to use port selectors for tunnels under certain
>>  instances, e.g., to restrict traffic to a server to be traffic of the
>>  sort appropriate to that server, based on the well known ports
>>  associated with the service.
>
>How have they handled the fragmentation issue in those cases, or have
>the simply assumed that the fragmentation will not happen, and ignored
>all of those packets.

I suggested that they work hard to ensure that there are no fragments 
emitted by hosts within their environments. This works for TCP 
services, which is what was of primary interest, but would not work 
for UDP. We recognized that the lack of detailed specs for how to 
deal with fragments was a problem.

Steve