Re: [IPsec] Handling Redirect Loops

2009-07-30 Thread Vijay Devarapalli
On 7/30/09 1:36 AM, "Tero Kivinen" wrote: > Vijay Devarapalli writes: >> 7. Handling Redirect Loops >> >>The client could end up getting redirected multiple times in a >>sequence, either because of wrong configuration or a DoS attack. The >>client could even end up in a loop with t

Re: [IPsec] Handling Redirect Loops

2009-07-30 Thread Yoav Nir
Vijar Devarapalli wrote: >Hi Yoav, > >On 7/29/09 9:13 PM, "Yoav Nir" wrote: > >> Hi Vijay. >> >> "default" is usually associated with a particular implementation or >> product. I think it would be better to say "suggested value" rather >> than "default value". > > "default value" is the right te

[IPsec] Handling Redirect Loops

2009-07-30 Thread Tero Kivinen
Vijay Devarapalli writes: > 7. Handling Redirect Loops > >The client could end up getting redirected multiple times in a >sequence, either because of wrong configuration or a DoS attack. The >client could even end up in a loop with two or more gateways >redirecting the client to

Re: [IPsec] Handling Redirect Loops

2009-07-29 Thread Vijay Devarapalli
m: ipsec-boun...@ietf.org [mailto:ipsec-boun...@ietf.org] On Behalf Of > Vijay Devarapalli > Sent: Thursday, July 30, 2009 1:33 AM > To: ipsec@ietf.org > Subject: [IPsec] Handling Redirect Loops > > Hello, > > During the IESG review of draft-ietf-ipsecme-ikev2-redirect,

Re: [IPsec] Handling Redirect Loops

2009-07-29 Thread Yoav Nir
PERIOD configuration variable is 300 seconds. These values MAY be configurable on the client. -Original Message- From: ipsec-boun...@ietf.org [mailto:ipsec-boun...@ietf.org] On Behalf Of Vijay Devarapalli Sent: Thursday, July 30, 2009 1:33 AM To: ipsec@ietf.org Subject: [IPsec] Hand

[IPsec] Handling Redirect Loops

2009-07-29 Thread Vijay Devarapalli
Hello, During the IESG review of draft-ietf-ipsecme-ikev2-redirect, it was brought up that the text about handling redirect loops should be in the main body of the draft instead of the security considerations section. One of the ADs also wanted some default values to detect a loop. Here is the mod