Subject: Re: [Ipsec] Issues regarding Traffic Selectors

From: Stephen Kent <[email-masked]>
Date: Mon, 1 Nov 2004 16:43:50 -0500

At 3:18 PM +0000 10/31/04, khan wadood wrote:
>hi,
>
>i have some issues regarding Traffic Selectors..
>
>1- Is there any need for Traffic Selectors in
>Transport mode ??

  Yes, traffic selectors are needed to decide how to map traffic to 
SAs for both transport and tunnel modes.

>2- There is no 1 to 1 mapping between Traffic Selector
>and SA in IKEv2, it seems to me that it is many to 1
>mapping between Traffic Selectors and SA, is it so ??

Each IKE child SA creation/rekey exchange creates a pair of SAs, 
based on the traffic selector payloads that are passed in the 
exchange.

>3- If so then how we get the selector value for an SA
>??

The initiator of an IKE exchange proposes a set of selectors from an 
SPD entry, based on matching an outbound packet against this entry in 
the initiator's SPD. The SPD was consulted for the outbound packet in 
question because there was no extant SA at the initiator to which the 
packet could be mapped.

Steve

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec