Re: IKEv2: prepending four octets

[Francis Dupont <[e-mail]>]

 In your previous mail you wrote:

   I think that we should at least agree that a peer that only works with port
   4500 such as Ravi describes should interoperate with all IKEv2
   implementations.
   
=> I agree.

   IOW an IKEv2 implementation must not assume that peers start the
   negotiations on port 500.

=> I agree.

   Coding a Remote Access client like that is
   acceptable, since clients always initiate the first IKE negotiation.
   Gateways may initiate the negotiation on port 4500 when working with IKEv2
   peers (in fact, this could be a recommendation at the SHOULD level), but
   they SHOULD also listen on port 500.
   
=> I believe we should give at least a MAY to initiate over 500 and 4500,
perhaps with a SHOULD for port 4500 if one knows there is a NAT and a SHOULD
for port 500 if one knows there is no NAT. In fact, this is more in the
scope of a BCP. About listening, I am in favor of a MUST for both 500
and 4500.

Regards

[e-mail]