Subject: RE: [Ipsec] Questions about internal address

From: "Soumya Sen" <[email-masked]>
Date: Fri, 8 Apr 2005 11:04:19 +0530

Hello,

The section 3.15 of the draft mentions the actions to be taken in the
cases Yoav mentioned in his mail. The paragraph in page 78 says:

   "If the data type requested in a CFG_REQUEST is not recognized or not
   supported, the responder MUST NOT return an error type but rather
   MUST either send a CFG_REPLY which MAY be empty or a reply not
   containing a CFG_REPLY payload at all. Error returns are reserved for
   cases where the request is recognized but cannot be performed as
   requested or the request is badly formatted."

Yoav mentions a case where: "(B) - the responder supports CFG, but
policy says that this user does not get it."

In this case, the CFG_REQUEST that is coming to the responder will be
recognized by him, but he will not be able to perform the request due to
some policy.
So going by the sentence of the draft "Error returns are reserved for
cases where the request is recognized but cannot be performed as
requested", wouldn't it mean that an error will be returned, and not a
reply without CFG_REPLY payload or empty CFG_REPLY?

Moreover, Tero mentioned that in case (B) we simply do not send
CFG_REPLY at all. Isn't there may be another option too i.e. the
Responder sends a reply not containing a CFG_REPLY payload at all?
Please let me know about these points.

Regards,
Soumya.

(Sorry for the attached Disclaimer, please ignore it. That is a company
policy so I can't remove it. Please bear with it ;-))

**********************************************************************************************************************************************************

This email message is for the sole use of the intended recipient(s)and may contain CONFIDENTIAL and PRIVILEGED information.
LG Soft India will not be responsible for any viruses or defects or any forwarded attachments emanating either from within
LG Soft India or outside. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended
recipient, please contact the sender By reply email and destroy all copies of the original message.

**********************************************************************************************************************************************************

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Fri, 8 Apr 2005 10:58:17 +0300

> reply without CFG_REPLY payload or empty CFG_REPLY?

It depends. If the traffic selectors are such, that they do require
IP-address, i.e. server should narrow them down, then I think it
should return error. In case the SA can be processed without
processing the configuration payload request, then SA should be
created, and no configuration payload is sent as a reply.

The example of first case is when client wants to allocate IP-address,
and gives any to any traffic selectors.

The example of the second case is when the client already has an
ip-address, and is using that in the traffic selectors, but wants to
ask server for the DNS server, but the server does not have any DNS
servers configured to be sent to the client. 

So, I would say both options are valid depending of the other policy
and of the request.
-- 
[email-masked]