Subject: [Ipsec] IKEv2 and Initial Contact

From: "Srinivasa Rao Addepalli" <[email-masked]>
Date: Fri, 10 Sep 2004 16:44:40 -0700

As I understand, SAi2, SAr2 and TSi, TSr are MUST payloads in AUTH exchange.
When the system restarts, the implementation are  expected to send INITIAL_CONTACT
notification to others so that the remote peers would reset any state information,
remote peer has with this node. Since this message needs to be cryptographically protected,
IKE SA needs to be negotiated with the peer. Note that, here the IKE SA is
not initiated due to the data packet. In this case, what should be the values of
SA and TS payloads. I guess, we can send send any values (may be all supported ones) in SAs so that
atleast one of the combination would be accepted by peer.  What are the appropriate
values for Traffic Selectors? 

Options, I can think of are:
1. Make SA and TS optional in AUTH exchange.  Is there any particular reason for not 
    making them optional.
2. Define some predefined value for SA and TS to indicate to the peer that they are not to
    be interpreted, so that peer does not fail the exchange.

What do other think about this?
Did I overlook any text in the draft?

Thanks
Srini

Intoto Inc.
www.intoto.com

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec