Subject: PIC port assignment

From: Yaron Sheffer <[email-masked]>
Date: Thu, 12 Jul 2001 23:36:57 +0200

As an aside to the current flame war, I'd like to clarify the issue of a separate port for PIC.

In the current draft, we have chosen to reuse the ISAKMP (*not* IKE) port, UDP/500. PIC is distinguished from IKE by a different ISAKMP Exchange Type, so this is formally OK.

This works fine theoretically, but may present problems when implementing a PIC Client and especially Authentication Server, on a machine that has an existing IKE implementation - port 500 is taken, and you're stuck unless you have access to the source code.

On the other hand, adding another port makes deployment a little more difficult, since the new port needs to be defined on firewalls.

And one more point, the recent IPSec-in-UDP draft uses port 500 for the whole IPSec session! If itbecomes standard, the port will be multiplexed anyway.

I'd like to hear opinions from the list, before applying (or not) for a port assignment.

Thanks,
	Yaron