Subject: [Mobike] Changes in NAT mapping

From: Eric Fung <[email-masked]>
Date: Mon, 21 Aug 2006 13:12:01 -0400

1) When the initiator detects a change in its NAT mapping (from a received
NAT_DETECTION_DESTINATION_IP payload), it does not actually know what the new
mapping is, and hence, following Sec. 3.5, does nothing to change its IKE_SA,
correct? It only sends UPDATE_SA_ADDRESSES to tell the peer to update its SAs' 
tunnel endpoints.

2) Can other INFORMATIONAL exchanges be used to detect changes in NAT mapping?
Sec 3.8 seems to imply only the IKE_SA_INIT exchange and exchanges containing
UPDATE_SA_ADDRESSES should be used.

_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: <[email-masked]>
Date: Tue, 22 Aug 2006 10:53:12 +0300

Eric Fung wrote:

> 1) When the initiator detects a change in its NAT mapping (from a
> received NAT_DETECTION_DESTINATION_IP payload), it does not 
> actually know what the new mapping is, and hence, following 
> Sec. 3.5, does nothing to change its IKE_SA, correct? It only 
> sends UPDATE_SA_ADDRESSES to tell the peer to update its SAs' 
> tunnel endpoints.

Correct; since the IKE_SA doesn't contain the old mapping (initiator
does not know it), there's nothing to update there when the mapping
changes.

> 2) Can other INFORMATIONAL exchanges be used to detect changes in
> NAT mapping?  Sec 3.8 seems to imply only the IKE_SA_INIT exchange
> and exchanges containing UPDATE_SA_ADDRESSES should be used.

Section 3.8 says that "the NAT_DETECTION_SOURCE_IP and
NAT_DETECTION_DESTINATION_IP notifications MAY be included in 
any INFORMATIONAL request", so the request does not have to
contain UPDATE_SA_ADDRESSES.

Best regards,
Pasi