RFC Errata


Errata Search

 
Source of RFC  
Summary Table Full Records

RFC 3947, "Negotiation of NAT-Traversal in the IKE", January 2005

Source of RFC: ipsec (sec)

Errata ID: 4937

Status: Reported
Type: Technical

Reported By: Nikolai Malykh
Date Reported: 2017-02-16

Section 6 says:

   The source IP and port address of the INITIAL-CONTACT notification
   for the host behind NAT are not meaningful (as NAT can change them),
   so the IP and port numbers MUST NOT be used to determine which
   IKE/IPsec SAs to remove (see [RFC3715], section 2.1, case c).  The ID
   payload sent from the other end SHOULD be used instead; i.e., when an
   INITIAL-CONTACT notification is received from the other end, the
   receiving end SHOULD remove all the SAs associated with the same ID
   payload.

It should say:

   The source IP and port number of the INITIAL-CONTACT notification
   for the host behind NAT are not meaningful (as NAT can change them),
   so the IP and port numbers MUST NOT be used to determine which
   IKE/IPsec SAs to remove (see [RFC3715], section 2.1, case c).  The ID
   payload sent from the other end SHOULD be used instead; i.e., when an
   INITIAL-CONTACT notification is received from the other end, the
   receiving end SHOULD remove all the SAs associated with the same ID
   payload.

Notes:

Port address should be replaced with port number.

Report New Errata