Subject: [Ipsec] Multi port router and SPD.

From: "mahdavi" <[email-masked]>
Date: Wed, 16 Feb 2005 22:36:52 +0330

Hi all. 
In a router can I use JUST ONE PAIR of SPDs (one for Inbound and another for
Outbound) for all incomming (or outgoing) packets from DIFFERENT PORTS of
router regardless of which port the packets are comming in ( or going out )? 

(Because of Implementation problems in hardware I want to use one policy for
all ports of router. Does this affects security of IPsec? ) 

PS: I want to be complient with rfc2401 not rfc2401bis. 

Best of regards.
mahdavi.

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Bill Sommerfeld <[email-masked]>
Date: Thu, 17 Feb 2005 20:17:29 -0500

> all ports of router. Does this affects security of IPsec? ) 

This sort of policy makes sense in a host implementation where the 
trusted area is entirely inside the box and all external ports
are equally untrusted.  

if your goal is to use IPsec to (for instance) secure management traffic
to or from the router itself, this could be ok.

If the goal is to protect traffic *through* the router you must exercise
extreme caution.