Re: [IPsec] draft-kivinen-ipsecme-esp-null-heuristics comments

[Tero Kivinen <kivinen at iki.fi>]

Bhatia, Manav (Manav) writes:
> > You gave reasons why ESP-NULL is needed, not why ESP-NULL visibility
> > is needed. 
> 
> One might want to filter OSPFv3 packets coming from outside the domain.

It is much better to do that check on the OSPFv3 receiver end where
the packet is actually authenticated by ESP-NULL, and which has much
better knowledge who is authorized to send what.

I do not know OSPFv3 that well, so I do not know how you tell which
packets are coiming outside of domain (as IP-addresses are not
authenticated in ESP-NULL, so those cannot be checked), so I cannot
really tell whether that check is doable or not.

So what are the exact checks you are doing and where inside the OSFPv3
packet content are those fields, and what do they gain compared of
doing the same checks on the final OSPFv3 receiver?

> Then when you're the end node, you might want to prioritize some
> OSPF packets over the others. I understand that the latter is an
> implementation specific issue, but it helps if the underlying
> protocol is amenable for deep inspection. 

End node already has all ESP-NULL related information, there is no
need for ESP-NULL visibility there.
-- 
kivinen at iki.fi