Subject: [Ipsec] Is it mandatory to have the incoming and outgoing SA protocol and encryption/auth algorithms same?

From: "Poorna Pushkala B" <[email-masked]>
Date: Fri, 9 Jun 2006 16:03:16 +0530

Hi,
I am relatively new to ipsec.
Is it mandatory to have the incoming and outgoing Security Association
protocol (AH/ESP) and encryption/auth algorithms same?
I went through RFC 2401, though it defines a Security Association, it is not
clear if for a given VPN tunnel, the incoming and outgoing SAs should use
the same protocol ( AH/ESP).

Can you help me?

Thanks & Regards
Kala. B
_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Stephen Kent <[email-masked]>
Date: Fri, 9 Jun 2006 09:51:41 -0400

At 4:03 PM +0530 6/9/06, Poorna Pushkala B wrote:
>Is it mandatory to have the incoming and outgoing Security 
>Association protocol (AH/ESP) and encryption/auth algorithms same?
>I went through RFC 2401, though it defines a Security Association, 
>it is not clear if for a given VPN tunnel, the incoming and outgoing 
>SAs should use the same protocol ( AH/ESP).
>
>Can you help me?
>
>Thanks & Regards
>Kala. B

Yes, both SAs make use of the same security protocol and algorithms. 
Look at the definition of an SPD entry for confirmation of this 
convention.

Steve