Re: [IPsec] multiple windows need multiple SPIs

2020-08-03 Thread Michael Rossberg
>> However, due to the combinatorial explosion, these blocks of SAs may easily >> become pretty >> large, ie. with a reservation for multicast senders and QoS groups SPIs may >> be a little short. > > Wow, what architecture are you implementing? After all, 2^32 SPIs by 2^32 > packets per SPI a

Re: [IPsec] multiple windows need multiple SPIs

2020-08-03 Thread William Allen Simpson
On 8/3/20 4:17 AM, Michael Rossberg wrote: Unfortunately I develop systems for a customer who uses DS for some (maybe non-technical) reason. Helpful to not use abbreviations. DS = storage Data Servers? AWS Directory Service? Microsoft Domain Services? The issue I am struggling with: If

Re: [IPsec] multiple windows need multiple SPIs

2020-08-03 Thread Yoav Nir
> On 4 Aug 2020, at 2:34, William Allen Simpson > wrote: > > On 8/3/20 4:17 AM, Michael Rossberg wrote: >> Unfortunately I develop systems for a customer who uses DS for some (maybe >> non-technical) >> reason. > > Helpful to not use abbreviations. DS = storage Data Servers? AWS Directory

Re: [IPsec] multiple windows need multiple SPIs

2020-08-03 Thread Valery Smyslov
Hi Michael, > One way out is Tero’s suggestion to add the sender IP address to the SA > lookup. If you properly implement ESP, than you must have already included source IP for SA lookup. It was explicitly added to cover Source-specific Multicast use case. And in case of SSM source addresses a