>> This is a pretty dubious way to use IKE. That aside for the moment,
it seems to me to be only one of a number of reasons why implementations
should track the _port_ they receive the initial message of a
conversation
from, not just the source IP address.
This does not work. You MUST use identities for tracking the SAs from
the same identity. If the host behind NAT is rebooted, there is
possibility that the NAT will allocate new IP and port for the host
when it connects again. Now the SGW will see connection coming with
new IP and new port, and the INITIAL-CONTACT will not clear the old
state away at all, meaning that it can still try to send the traffic
to old SAs (== black hole).
Are you saying that an identity may use IPSec from one device only?
It seems to me that I may want to establish a phase 1 SA with you from
two different work stations at the same time. Are you saying that I
would need 2 phase 1 IDs to do that? Is it a generally accepted limitation
of IPSec that identities are tied to a particular device? This would have
to be true in order to process an INITIAL-CONTACT notification based on IDs
only.