Subject: RE: [Mobike] RE: issue 34 -- ESP vs. IKE based NAT reboot detection

From: <[email-masked]>
Date: Thu, 1 Sep 2005 15:27:32 +0300

Mohan Parthasarathy wrote:

> If you do IKEv2 like updates, then you need a separate PATH_TEST
> message (outside the SA) so that PATH_TEST does not cause updates to
> SA. By requiring an explicit update, we avoid a separate PATH_TEST
> message. Is that an advantage ?

Actually, we need a separate PATH_TEST message even with the explicit
update if we want to be able to do path testing at any time without
the possibility of disrupting things.

(And IMHO having a separate path test message that does nothing else
would also make MOBIKE easier to understand, even though it may
require a couple of more lines in code.)

Best regards,
Pasi
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Tero Kivinen <[email-masked]>
Date: Thu, 1 Sep 2005 15:52:30 +0300

> the possibility of disrupting things.

You mean the case, where we have decided to move to new address, but
that new address breaks down after us testing it and after we sent
update to it, but before we get reply back to it? I think we do not
disrupt things more even if we use the IKE SA update message for
testing the path. The path is already broken, so we cannot disrupt it
more. After we get the IKE SA update message through, we have then
already fixed the situation, with separate path test we still need to
wait one more extra round trip to fix the situation (i.e we first use
the PATH_TEST to find the working path, and then send the packet to
that address, compared to using the IKE SA update message to do the
path test, and that will immediately fix the situation when the
correct path is found (or in case of unidirectional paths, then we
need to wait the another round trip, i.e. for the second address
update to reach the host)). 
-- 
[email-masked]
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Mohan Parthasarathy <[email-masked]>
Date: Thu, 1 Sep 2005 10:12:03 -0700 (PDT)

> update to reach the host)). 

The only time this won't work is when the window is
already closed. In that case, you retransmit with new
address and then on getting a response, send an IKE
message with the UPDATE_SA_ADDRESS payload. This is
the same as sending PATH_TEST message and then use the
results of PATH_TEST message for sending the IKE
message.

-mohan