Subject: SPI for VRRP messages

From: "Lior Bahat" <[email-masked]>
Date: Mon, 4 Mar 2002 14:18:31 +0200

I am looking for information about how to set the Security Parameters Index in the Authentication Header for VRRP multicast messages ?
Any pointers will be appreciated.

Thanks,
  Lior

---

From: "Smith, Mark - Sydney" <[email-masked]>
Date: Tue, 5 Mar 2002 07:37:30 +0800

Hi Lior,

The SPI for the AH header under VRRP would be set via an IPsec (RFC 2401)
mechanism eg manually, or negotiated by IKE / ISAKMP.

Section 10 of RFC 2338 is listing the ways of protecting the VRRP messages,
which IPsec AH the most strongly recommended. 

Regards,
Mark.

> -----Original Message-----
> From: Lior Bahat [mailto:[email-masked]]
> Sent: Monday, 4 March 2002 23:19
> To: [email-masked]
> Subject: SPI for VRRP messages
> 
> 
> I am looking for information about how to set the Security 
> Parameters Index in the Authentication Header for VRRP 
> multicast messages ?

-- Please excuse any advertisments that appear below this line -- 
--
WORLDCOM. THE BEST COMMUNICATION SERVICES IN THE WORLD. 
       -- Based on World Communications Association 2001 Award
For more information, visit www.worldcom.com/asiapacfic
-----------------------------------------------------------------
This communication contains information which is confidential and 
may also be privileged.  It is for the exclusive use of the 
intended recipient(s).  If you are not the intended recipient(s), 
please note that any distribution, copying or use of this 
communication or the information in it is strictly prohibited.  
If you have received this communication in error, please notify 
the sender immediately and then destroy any copies of it.

---

From: "Alexandre CASSEN" <[email-masked]>
Date: Mon, 18 Mar 2002 09:01:36 +0100

Hi Lior,

>I am looking for information about how to set the Security Parameters
Index in the Authentication Header for VRRP multicast >messages ?
>Any pointers will be appreciated.

  /* The SPI value is filled with the ip header source address.
     SPI uniquely identify the Security Association (SA). This value
     is chosen by the recipient itself when setting up the SA. In a
     multicast environment, this becomes unfeasible.

     If left to the sender, the choice of the SPI value should be done
     so by the sender that it cannot possibly conflict with SPI values
     chosen by other entities sending IPSEC traffic to any of the
receivers.
     To overpass this problem, the rule I have chosen to implement here is
     that the SPI value chosen by the sender is based on unique information
     such as its IP address.
     -- INTERNET draft : <draft-paridaens-xcast-sec-framework-01.txt>
  */

=> Can be a way to do this,

Best regards,
Alexandre Cassen