Subject: [IPsec] questions about ipsecme-mpsa

From: Michael Richardson <[email-masked]>
Date: Mon, 29 Jul 2013 14:56:49 -0400

Thank your this draft.

As I understand MPSA, the gateway simply generates incoming/outgoing SA
pairs.   I get the impression that the same information is sent to each
CPE?

What is this multi-point SA mentioned?
Assuming that one wanted to do this, I don't see how CPE_A knows to send C's
traffic to CPE_C.  Where are the tunnel outer information configured?

It seems to me at least some traffic selectors are needed.

--
Michael Richardson <[email-masked]>, Sandelman Software Works

---

From: yamaya <[email-masked]>
Date: Wed, 31 Jul 2013 01:17:01 +0900

Thanks for your comment.

> pairs.   I get the impression that the same information is sent to each

Yes, the gateway sends the same information to CPEs, so that each CPE 
shares a single SA.

> traffic to CPE_C.  Where are the tunnel outer information configured?

CPE_A knows that information by another protocol, such as BGP, not by 
MPSA. For example, using BGP with RFC5512 and 5566, CPE_A learns 
prefixes and tunnel end points, and knows which packets will be tunnled 
in MPSA from the prefixes and to which addresses thet packets will be sent.
CPE_A encapsulates a packet with MPSA information, but CPE_A knows 
tunnel outer information and etc from BGP.

I think that other protocols can be used, LISP, etc., not only BGP.

--
Arifumi Yamaya

> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec
>