Subject: Re: [Mobike] 44 - nat changes and ike rekey

From: <[email-masked]>
Date: Mon, 24 Oct 2005 15:49:51 +0300

Jari Arkko wrote:
> Text proposal:
> 
> Section 4.4
> 
>      The initiator receives a NAT_DETECTION_DESTINATION_IP
>      notification that does not match the previous UPDATE_SA_ADDRESSES
>      response (see Section 4.7 for a more detailed description).
> 
> =>
> 
>      The initiator receives a NAT_DETECTION_DESTINATION_IP
>      notification with a value that does not match the value in a
>      previous UPDATE_SA_ADDRESSES response (see Section 4.7
>      for a more detailed description).
> 
>      Note that this may cause an extra address update when
>      IKE rekeying is in progress, because the 
>      NAT_DETECTION_DESTINATION_IP
>      notification only contains a hash of the address and some
>      other values such as the SPIs which change upon IKE rekey.
>      Such an extra address update is harmless, however.

Probably the "Changes in NAT Mappings" section is a better place
for this text than 4.4. I rephrased it slightly as follows:

   Note that this approach to detecting NAT mapping changes may cause an
   extra address update when the IKE_SA is rekeyed.  This is because the
   NAT_DETECTION_DESTINATION_IP hash also includes the IKE SPIs, which
   change when performing rekeying.  This unnecessary update is
   harmless, however.

Best regards,
Pasi
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Jari Arkko <[email-masked]>
Date: Mon, 24 Oct 2005 16:20:59 +0300

>   change when performing rekeying.  This unnecessary update is
Ok.

--Jari

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Mon, 24 Oct 2005 22:17:27 -0700

>    change when performing rekeying.  This unnecessary update is
I am okay with this. 

Note we are talking about "Changes in NAT mappings". Is it okay for an implementation 
to implement just one of the two schemes

 1) send NAT-D payloads in DPD messages, compare the response with the previou
     UPDATE_SA_ADDRESS response
2)  send NAT-D payloads in DPD messages with UPDATE_SA_ADDRESSES

-mohan