[Ipsec] big IKE packets

[Tero Kivinen <kivinen@iki.fi>]

Michael Richardson writes:
> I wonder if one solution to the problem of large IKE packets
> (that require fragmentation) wouldn't be to define a fragmentation
> header in IKE.

There is also such method, it is called IP. The IP packets already
offers fragmentation, why should we do it again on the IKE level?

If the operating system vendor who implemented IP stack didn't know
how to make the fragmentation, how can you expect him to be able to
make IKE fragmentation to the IPsec stack of the OS?

The only difference would be the separate acks for fragments, but I do
not think this fragmentation in IKE would really help, as it just adds
one more complicated option, and I think people would be leaving the
implementation of it out from their products.

The HTTP transfer of certificates is much better sulution for that.
-- 
kivinen@safenet-inc.com

_______________________________________________
Ipsec mailing list
Ipsec@ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec