Subject: RE: [Ipsec] ICMP and MH TSs for IKEv2

From: [email-masked]
Date: Mon, 5 Sep 2005 20:01:26 +0300

Francis Dupont wrote:
>  In your previous mail you wrote:
> 
>    >  - the MH type is in the local "port" selector. What is 
>    >  the "local" TS, TSi only, or MH type and ICMP type/code 
>    >  are "aligned" (and how)?
>    
>    I'm starting to lean on solution, where ICMP/MH type/code's 
>    in SA's TS  would always be in both local/remote port (or 
<    src/dst port). This way, even multicast SA's would work 
>    without any special handling (an MC SA that would be used 
>    for both receiving and sending).
>    
> => I agree this solution seems good but it was only suggested and 
> only for ICMP in the clarifications I-D.

I agree, this solution seems to apply both to ICMP and MH. We'll 
add some text about this in the next version of the clarifications 
I-D (hopefully appearing before the Toronto IPsec/IKEv2 interop).

Best regards,
Pasi

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Stephen Kent <[email-masked]>
Date: Tue, 6 Sep 2005 10:40:43 -0400

>I-D (hopefully appearing before the Toronto IPsec/IKEv2 interop).

Guys,

We specifically allow asymmetry for ICMP traffic for an SA, e.g.,  so 
that one can send but not accept traffic for a given ICMP message 
type for an SA. I believe we discussed this issue on the list at the 
time the decision  was made, so please do not plan to just change by 
treating it as a clarification.

2401-bis would also have to change, not just IKEv2.

Steve