On (05/02/17 09:58), Paul Wouters wrote: > I think you want to use Opportunistic IPsec, eg see > https://libreswan.org/wiki/HOWTO:_Opportunistic_IPsec I dont think that what I want is opportunistic ipsec.. taking an extreme example, I can set up the ipsec tunnels with esp-null for *.5001 and 5001.* (and that's how I'm able to trigger quick mode in my experiment). But I want each 5-tuple to/from 5001 to get its own SPI. That is not happening in my case. If I used OE, I would *never* get a per-5-tuple SPI, right? (I can give this a try later today but the rfc definition of OE is not what I have in mind- I really want PFP, not OE). > Note that IKEv2 also allows you to define one connection and instantiate > a connection based on the trigger packet whose src/dst proto/port are > included in the IKEv2 packet as traffic selectors. See RFC7296 and > "narrowing". yes, the rfc's permit this, I'm not sure how to set up my SPD for this though.
