Subject: [Mobike] 44 - nat changes and ike rekey

From: Jari Arkko <[email-masked]>
Date: Sun, 23 Oct 2005 17:08:02 +0300

Text proposal:

Section 4.4

     The initiator receives a NAT_DETECTION_DESTINATION_IP
     notification that does not match the previous UPDATE_SA_ADDRESSES
     response (see Section 4.7 for a more detailed description).

=>

     The initiator receives a NAT_DETECTION_DESTINATION_IP
     notification with a value that does not match the value in a
     previous UPDATE_SA_ADDRESSES response (see Section 4.7
     for a more detailed description).

     Note that this may cause an extra address update when
     IKE rekeying is in progress, because the NAT_DETECTION_DESTINATION_IP
     notification only contains a hash of the address and some
     other values such as the SPIs which change upon IKE rekey.
     Such an extra address update is harmless, however.

--Jari

_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: <[email-masked]>
Date: Fri, 28 Oct 2005 13:19:20 +0300

Mohan Parthasarathy wrote:
>
> I am okay with this. 
> 
> Note we are talking about "Changes in NAT mappings". Is it 
> okay for an implementation to implement just one of the 
> two schemes
> 
> 1) send NAT-D payloads in DPD messages, compare the response 
>     with the previou UPDATE_SA_ADDRESS response
> 2) send NAT-D payloads in DPD messages with UPDATE_SA_ADDRESSES

The spec allows the initiator to decide which way it wants to do, 
but doesn't require any particular method of choosing. Hardcoding
is obviously one valid way (but so are a configuration option
and dynamic selection based on some heuristic).

The responder will support both anyway (but doesn't really need 
additional code, since it cannot know whether a message is 
"DPD message" or something else).

Best regards,
Pasi