Subject: RE: [Ipsec] big IKE packets

From: "Yoav Nir" <[email-masked]>
Date: Wed, 1 Sep 2004 14:44:29 +0300

Oops, sorry. I meant Michael's idea.

-----Original Message-----
From: Yoav Nir [mailto:[email-masked]] 
Sent: Wednesday, September 01, 2004 10:04 AM
To: 'Michael Richardson'; 'Paul Hoffman / VPNC'
Cc: [email-masked]'; [email-masked]'
Subject: RE: [Ipsec] big IKE packets 

<snip>

I'm just not sure Suren's idea is the best way to solve this.  What my
company did was to allow IKE to pass over TCP (we used port 500).  This has
some advantages, and some disadvantages.
<snip>

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Michael Richardson <[email-masked]>
Date: Wed, 01 Sep 2004 14:32:53 -0400

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Yoav" == Yoav Nir <[email-masked]> writes:
    Yoav> Oops, sorry. I meant Michael's idea.

  So, I'm not attached to it.

  Running over TCP is certainly an option --- but as you indicate it
means switching somehow to UDP if you need to do NAT-T.

  That's why I suggested a mechanism that lives entirely within IKE, 
and that permits IKE to verify that each fragment arrived independantly.
  
  I believe that we will see some increase in host<->host IPsec to
secure long-lived TCP connections against attacks. 
  I would hate to introduce an unprotected, long-lived TCP connection.

- --
]     "Elmo went to the wrong fundraiser" - The Simpson         |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] [email-masked]      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [