[Design] road warrior and id field.

Kaustubh Kumbhalkar writes:
> In RFC 2409 "The Internet Key Exchange (IKE)",

The value of IDii is used by the responder to determine whether it wants to setup a connection with the initiator. To a certain extent it doesn't matter what is in there as long as the responder will accept it as identifying the initiator. Assuming that the responder has been told to identify the initiator by the IP address I3 (as opposed to whatever the IP address of the initiator actually is) then it does *not* imply that return packets will go to I3. The return packets will still go the initiators address.

> this way it is not possible to negotiate for an SA having address other

ISAKMP SAs are between an initiator and responder and only protect ISAKMP/IKE traffic between those machines. Once you have an ISAKMP SA then Quick Mode can be used to negotiate :-

• a transport or tunnel mode IPsec SA between the initiator and responder to secure all other traffic between the machines.
• a tunnel mode IPsec SA between addresses that are protected by the initiator and responder e.g. subnet<->subnet security. In this case the IDci and IDcr in the *Quick Mode* SA negotiation will be different from the initiator and responder addresses.

  ---

  Design mailing list Design@lists.freeswan.org http://lists.freeswan.org/mailman/listinfo/design