Subject: ICIM: IPsecAction granularity

From: Ricky Charlet <[email-masked]>
Date: Tue, 09 Jan 2001 17:30:12 -0700

Howdy,

	I dislike the granularity property of IPsecActions. It purports to be
controlling whether subnet mask, or protocol, or port fields should be
wild-carded in SA Proposals. And this makes the granularity property
part of a selector. I think any property of a selector should be over on
the Filter Entry side and not in an IPsecAction.

-- 
  Ricky Charlet   : Redcreek Communications   : usa (510) 795-6903

---

From: "Lee Rafalow" <[email-masked]>
Date: Wed, 10 Jan 2001 10:46:24 -0500

Ricky, Here's the reasoning for its location in the model.

The conditions (filters) are used to determine which rule applies to a
packet (for which there's currently no SA).  As with other action
properties, the granularity is used to determine how to negotiate and build
the SA.  In this case, the granularity is used (in conjunction with the
filters) to determine the selector for a given IPsec SA.

So, the same rule can be evaluated (i.e., filter) and yield different
selectors.

IHTH.  Lee