Subject: Re: Issue #68: VPNs with overlapping IP address ranges (was Re: 2401bis issues (possible) resolution)

From: Michael Richardson <[email-masked]>
Date: Mon, 01 Dec 2003 14:03:54 -0500

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Tero" == Tero Kivinen <[email-masked]> writes:
    >> When a security Gateway is operating on behalf of multiple contexts
    >> (e.g. multiple subscribers, or multiple ppvpn-style overlay addressing
    >> contexts), it is essential that the initiator be able to convey to the
    >> responder which context is being addressed.

    Tero> Do not use IP addresses as a IKE SA identities then. Use the dns
    Tero> names or email addresses or something else. There is no need to use
    Tero> ip addresses in those cases (or actually using ip addresses would
    Tero> be quite bad, as it is not unique...).

  I concur.
  Particularly for IKEv2, the #1 reason to use IP addresses as IDs in IKEv1
was because of limitations of PSK.

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] [email-masked]      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [