<html><body><div style="color:#000; background-color:#fff; font-family:arial, helvetica, sans-serif;font-size:12pt"><div><span>Greetings,</span></div><div><br><span></span></div><div><span>Just plowed through RFC 4555 and 4621 for guidance. The spec says put the currently used address in the IP header</span></div><div><span>and the rest as additional addresses. Thus excluding "me" in the additional_addresses list is correct.<br></span></div><div><span>But there is this sentence in rfc4621, section 6.4:</span></div><div><span><br></span></div><div><span>"</span>To support NAT-T, the IP addresses of the received packet are considered as one address of the peer, even when they are not present in the list."</div><div><br></div><div>Seems MOBIKE message processing needs to store the message's source IP addr along with the other ADDITIONAL_IPV4_ADDRESS. Use ike_sa to "remember" this address separately is not safe. It requires<br></div><div>code to add it in
the additional_addresses list before it is overwritten by N(UPDATE_SA_ADDRESSES).</div><div><br></div><div>Regards,</div><div>Simon<br></div><div><br></div><div><br></div> <div style="font-family: arial,helvetica,sans-serif; font-size: 12pt;"> <div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"> <div dir="ltr"> <font face="Arial" size="2"> <hr size="1"> <b><span style="font-weight: bold;"></span></b></font></div><div id="yiv1090343885"><div><div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-family: arial,helvetica,sans-serif; font-size: 12pt;">To verify this theory, we made the following change in ike_mobike.c:<br><pre class="yiv1090343885bz_comment_text" id="yiv1090343885comment_text_4">------------------------------------------------------------<br>if (first)<br>{ /* an
ADDITIONAL_*_ADDRESS means replace, so flush once */<br> this->ike_sa->remove_additional_addresses(this->ike_sa);<br> first = FALSE;<br><br> // Added code to seed the IP address in SA in the additional_address list<br> host = this->ike_sa->get_other_host(this->ike_sa);<br> host = host->clone(host);<br> this->ike_sa->add_additional_address(this->ike_sa, host);<br>}<br>------------------------------------------------------------<br>After applying this change to a road warrior, it can switch back and forth between the 2 interfaces.<br><br>Questions:<br>1. Is there reason why the peer IP address in the Security Association not stored in the additional_address list?<br>2. Can anyone see potential problems with the code change above? <br> Not sure if there may be situations when ike_sa->get_other_host() may not return the correct gateway address.<br> The change tested OK in our lab though.<br>3. Another possibility
is to change the gateway side to include "me" in the Mobike additional addresses.<br> It is easier to upgrade one host than upgrading a fleet of 800 trucks. Similar to Question 1, is there<br> reason that "me" must be excluded from the Mobike additional addresses?<br><br>Thanks in advance for help.<br>Simon <br></pre></div></div></div><br><br> </div> </div> </div></body></html>