> For example, if one believes that attackers are not capable > of a MITM attack, then one could implement a simple, fast > check of the SPI associated with each IPsec (ESP) packet, on > a line card. Thus off-path attacks would be rejected > efficiently. Alternatively, if future management processors > had adequate horsepower to process IPsec traffic at high > speeds, e.g., via hardware assist, then the problem would > vanish as well. I've explored that path. Too complicated to code and high on the maintenance side (too big of OPEX increase).
Note Well: Messages sent to this mailing list are the opinions of the senders and do not imply endorsement by the IETF.