Re: [IPsec] Issue #213/ #214 - Allow for non-direct end point connectivity

2012-05-14 Thread Vishwas Manral
Hi Yaov, Thanks for the information. What you seem to be talking about is iterative topology discovery, and not data plane packet forwarding. I will try to clarify it further. Thanks again, Vishwas On Mon, May 14, 2012 at 2:14 PM, Yoav Nir y...@checkpoint.com wrote: On May 12, 2012, at

Re: [IPsec] Issue #213/ #214 - Allow for non-direct end point connectivity

2012-05-12 Thread Yoav Nir
I'm not sure I understand the suggested resolution. The biggest barrier to direct connectivity is that the responder may be behind NAT. Is this considered a routing issue? In any case, there are protocols for getting to a responder behind a NAT. They work well enough that VoIP solutions work

Re: [IPsec] Issue #213/ #214 - Allow for non-direct end point connectivity

2012-05-12 Thread Vishwas Manral
Hi Yaov, I do see NAT traversal as a requirement and should be made part of the problem statement. I however do not see it as a resolution of #213 or #214. I see resolution for #218 and #211 talk about NAT. Routing is about how packet is sent to the nexthop closer to the destination, which is

[IPsec] Issue #213/ #214 - Allow for non-direct end point connectivity

2012-05-11 Thread Vishwas Manral
Hi, Description: Direct endpoint-to-endpoint connectivity may not be possible. Should gateways figure things out completely or just punt endpoints to a closer gateway? Detail Arguments: As Izaac and John Lesser pointed out this is more of a routing issue. Though current solutions do not allow