Subject: multiple SA's per CREATE

From: Michael Thomas <[email-masked]>
Date: Sat, 25 Aug 2001 14:17:04 -0700 (PDT)

Right now, if you want to CREATE multiple SA in the
same message, there's two different ways you can
format the message:

1) Create multiple KINK ISAKMP payloads with the
   normal quick mode payloads inside

2) Take advantage of IKE's ability to have multiple
   different ISAKMP sets of messages in the same
   body

While we could allow for both, I think it would be
better to choose one to keep the complexity down.
I'd generally favor (1) because it provides the
additional benefit of "bracketing" each of the
SA's... something that's a little hazy with IKE
right now (I'm not even sure that this is a well
implemented/tested feature). It would also provide
a well-defined means of allowing per SA
notifications to be able to report errors which
are specific to the SA which had trouble.

Or... we could just deem all multi-SA commands
bogus :-)

	Mike

---

From: Jan Vilhuber <[email-masked]>
Date: Sat, 25 Aug 2001 15:55:14 -0700 (PDT)

> are specific to the SA which had trouble.
I concur that 1 sounds reasonable.

jan

 --
Jan Vilhuber                                            [email-masked]
Cisco Systems, San Jose                                     (408) 527-0847