ipsec October 2009 archive
Main Archive Page > Month Archives  > ipsec archives
ipsec: Re: [IPsec] Closing the IKEv2bis open issues

Re: [IPsec] Closing the IKEv2bis open issues

From: Yoav Nir <ynir_at_nospam>
Date: Wed Oct 21 2009 - 07:46:27 GMT
To: Paul Hoffman <paul.hoffman@vpnc.org>

A few lines above this section it already says "If the responder's policy allows it to accept the first selector of TSi and TSr, then the responder MUST narrow the traffic selectors to a subset that includes the initiator's first choices."

So there is a MUST requirement to select the initiator's first choice (if possible), so I don't think the SHOULD and MAY are appropriate here. The way I read this section, it only clarifies what to do if the initiator traffic selector (first or not) is too broad. In that case, we shouldn't mention the initiator's choices.

On Oct 20, 2009, at 6:19 PM, Paul Hoffman wrote:

> Issue #25, Choice of the right TS when narrowing
> Proposed change:
> When narrowing is done, there may be several subsets that are
> acceptable but their union is not. In this case, the responder
> SHOULD select the initiator's first choice (to be interoperable
> with RFC 4306), but MAY arbitrarily select any of them,
> and MAY include an
> ADDITIONAL_TS_POSSIBLE notification in the response.

IPsec mailing list