Subject: [Idr] questions about RFC5566 BGP IPsec Tunnel Encapsulation Attribute

From: Linda Dunbar <[email-masked]>
Date: Fri, 3 Apr 2020 23:34:00 +0000

Lou,

Since you are the first author to RFC 5566  BGP IPsec Tunnel Encapsulation Attribute, hope you (or anyone who knows the answer) can answer some questions I have about the draft.

Section 3 states that if R1 receives an Encapsulation SAFI update from R2, R1 must initiate IPsec SA to R2 for all traffic with R2 as the nexthop.

My question is that the UPDATE from R2 may be propagated to many nodes, do all those receivers have to initiate the IPSec SA with R2?
I would image all those nodes that need to establish IPsec SA with R2 should be configured by their administer, isn't it? How can a node trust another node to initiate an IPsec SA?

Thank you very much.
Linda Dunbar