Re: IPsecAction granularity

["Lee Rafalow" <rafalow@xxxxxxxxxxxxxxx>]

Ricky, Here's the reasoning for its location in the model.

The conditions (filters) are used to determine which rule applies to a
packet (for which there's currently no SA).  As with other action
properties, the granularity is used to determine how to negotiate and build
the SA.  In this case, the granularity is used (in conjunction with the
filters) to determine the selector for a given IPsec SA.

So, the same rule can be evaluated (i.e., filter) and yield different
selectors.

IHTH.  Lee

----- Original Message -----
From: "Ricky Charlet" <rcharlet@xxxxxxxxxxxx>
To: ".ipsec-policy" <ipsec-policy@xxxxxxxx>
Sent: Tuesday, January 09, 2001 7:30 PM
Subject: ICIM: IPsecAction granularity


> Howdy,
>
> I dislike the granularity property of IPsecActions. It purports to be
> controlling whether subnet mask, or protocol, or port fields should be
> wild-carded in SA Proposals. And this makes the granularity property
> part of a selector. I think any property of a selector should be over on
> the Filter Entry side and not in an IPsecAction.
>
>
> --
>   Ricky Charlet   : Redcreek Communications   : usa (510) 795-6903