Subject: [IPsec] Issue #137: Sending INVALID_IKE_SPI notification inside an existing IKE_SA

From: Paul Hoffman <[email-masked]>
Date: Mon, 18 Jan 2010 18:25:35 -0800

Section 1.5: I noticed the 1st paragraph nowadays (well, since -00 of the WG draft) allows sending INVALID_IKE_SPI notification inside an existing IKE_SA. This contradicts a MUST NOT in RFC 4306, and I'm not sure if it really brings any benefits?

--Paul Hoffman, Director
--VPN Consortium