Subject: [MSEC] Re: draft-ietf-msecipsec-extensions-04.txt

From: Brian Weis <[email-masked]>
Date: Mon, 6 Nov 2006 14:49:54 -0800

Hi Tero,

Thanks for the correction on the IKEv2 reference ... we'll fix that  
in the next draft. I also believe that the notion of "comparable" in  
the final sentence intends to say that the GKM must have a facility  
that achieves the same result (which may be similar to IKEv1, IKEv2,  
or something else entirely). We'll clarify that as well.

Thanks,
Brian

On Nov 6, 2006, at 2:11 PM, Tero Kivinen wrote:

>> 6.3.3.6 UDP Checksum Dependency on Source IP Address
> ...
>>    In a transport mode multicast application GSA, the UDP checksum
>>    operation requires the origin endpoint's IP address to complete
>>    successfully. In IKEv2, this information is exchanged between the
>>    endpoints by a NAT-OA payload (NAT original address). See also
>>    reference [RFC3947]. A comparable facility must exist in a GKM
>>    protocol payload that defines the multicast application GSA
>>    attributes for each Group Speaker.
>
> IKEv2 do not use NAT-OA payloads at all. NAT-OA payloads are only  
> used in the IKEv1. The RFC 4306 section 2.23 says:
>
>       The original source and destination IP address required for the
>       transport mode TCP and UDP packet checksum fixup (see [Hutt05])
>       are obtained from the Traffic Selectors associated with the
>       exchange.  In the case of NAT traversal, the Traffic Selectors
>       MUST contain exactly one IP address, which is then used as the
>       original IP address.
>
> I.e. the original IP addresses for the cehcksum fixup are taken from
> the traffic selectors.
> -- 
> [email-masked]

-- 
Brian Weis
Advanced Security Development, Security Technology Group, Cisco Systems
Telephone: +1 408 526 4796
Email: [email-masked]
_______________________________________________
msec mailing list
[email-masked]
http://six.pairlist.net/mailman/listinfo/msec