Subject: RE: [Ipsec] INVALID_IKE_SPI

From: [email-masked]
Date: Wed, 29 Jun 2005 11:10:39 +0300

Oops, we somehow missed that text in Section 2.21; thanks 
for pointing it out. We'll update the clarifications
draft accordingly.

Best regards,
Pasi

> -----Original Message-----
> From: Mohan Parthasarathy
> Sent: Wednesday, June 29, 2005 4:09 AM
> To: IPsec WG; Paul Hoffman
> Subject: Re: [Ipsec] INVALID_IKE_SPI
> 
> 
>  In section 2.21,
>    If a node receives a message on UDP port 500 or 4500 outside 
>    the context of an IKE_SA known to it (and not a request to 
>    start one), it may be the result of a recent crash of the node.  
>    If the message is marked as a response, the node MAY audit the 
>    suspicious event but MUST NOT respond. If the message is marked 
>    as a request, the node MAY audit the suspicious event and MAY 
>    send a response. If a response is sent, the response MUST be 
>    sent to the IP address and port from whence it came with the 
>    same IKE SPIs and the Message ID copied. The response MUST 
>    NOT be cryptographically protected and MUST contain a Notify 
>    payload indicating INVALID_IKE_SPI.
> 
> This says, that the IKE header has the SPIs just copied back. You 
> also have to copy back the "Initiator" flag so that the receiver 
> of the notification can locate the SA appropriately.
> 
> -mohan

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec