Subject: [pim] Authenticatng link-local messages

From: "Salekul Islam" <[email-masked]>
Date: Mon, 14 Apr 2003 14:07:36 -0400

Hi,

I have two questions related to authenticating link-local messages. I am expecting that someone will make me clear.

1. In PIM-SM spec it is suggested that we should use IPsec AH to protect link-local messages. It is also said that all link-local messages use SPI = 0. As far my understanding, we are using one SA to protect all the link-local messages and for these messages the destination address is 224.0.0.13 and it is fixed. SPI, destination address and specific protocol are used to differentiate a particular SA from more than one SAs. In this case we are using one SA for all link-local messages and all the time their destination address is fixed. That's why we don't need any SPI value to differentiate this SA. And this is the reason that SPI = 0 is used. Am I correct or missing something?

2. in PIM-SM spec it is assumed that the netowrk admin will configure all the PIM routers manually with one or more SAs. I think we have some overhead here. Shall we configure all the routers blindly? How do one know which routers are going to be used ? 

If we want to use any negotiating protocol to establish the SAs, when these routers will be configured? 

Thanking you

Salekul