design draft issue: existing documents claim
Tero Kivinen <kivinen <at> iki.fi>
2006-01-03 15:26:48 GMT
Jari Arkko writes:
> > IKEv2 assumes that an IKE SA is created implicitly between the IP
> > address pair that is used during the protocol execution when
> > establishing the IKEv2 SA. This means that, in each host, only one
> > IP address pair is stored for the IKEv2 SA as part of a single IKEv2
> > protocol session, and, for tunnel mode SAs, the hosts places this
> > single pair in the outer IP headers. Existing documents make no
> > provision to change this pair after an IKE SA is created.
> But doesn't NAT-T allow a limited form of changes?
There is text in the RFC 4306 section 2.23 saying that implementation
SHOULD dynamically update the address of the host behind NAT if they
detect it is changed, but that is only limited for the NAT-T case and
only so that host not behind NAT does that for host behind NAT.
I added text saying "(except for dynamic address update of NAT-T)" to
kivinen <at> safenet-inc.com