Re: draft-ietf-ipsec-ikev2-04.txt

[Michael Richardson <mcr@xxxxxxxxxxxxxxxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----


>>>>> "Ari" == Ari Huttunen <Ari.Huttunen@xxxxxxxxxxxx> writes:
    Ari> Also, IMHO, INTERNAL_ADDRESS_EXPIRY attribute should not exist. It's
    Ari> a way to negotiate connection lifetime. It would be more in the spirit
    Ari> of IKEv2 if the GW would enforce this by forcing a connection re-key
    Ari> and would CFG_SET a new IP address if it needs to change (both in the
    Ari> same message pair).

  Strongly agree. Get rid of lifetime info. Just rekey when you feel you should.

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] mcr@xxxxxxxxxxxxxxxxxxxxxx http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
Comment: Finger me for keys

iQCVAwUBPh8kDIqHRg3pndX9AQEDvgQAsMwSWbrTWrM4+A1EI7myhEhGYnlpkt5W
jqpaqd2gBYwI2Zx5N3OWNQGe7MyJIqsCto/t4MlusAYYy1uHzaql31lNjcVsqPm9
LxQWmhwMqCTLGL3Is1IgjWPz6aEV+/bUrM3l8lEtd6HfVtpGUW37I9vSqNXCYlrB
AYxq6W9U+gg=
=NCXA
-----END PGP SIGNATURE-----