Hi Patricia, > Can this packet be tunneled at that point? are initiator and responder > updating the SAs after the liveness test? I think this packet should not > be received through the tunnel until the handover process ends. > > Is the return routability check activated by default? by who?
In the current implementation charon as the initiator of a MOBIKE exchange updates the IPsec SAs right after it determined a working address pair. At the same time, it sends the address update which also includes a COOKIE2 payload, thus, is acting as routability check. The responder only updates the addresses of the IPsec SAs after receiving an address update. Since the observed ESP packet and the address update do not necessarily have to arrive in that order, it could very well be that the other peer successfully receives the ESP packet. Regards, Tobias _______________________________________________ Users mailing list Users@lists.strongswan.org https://lists.strongswan.org/mailman/listinfo/users