Must the source IP in SA (used for outgoing packets) be the sender's IP?

arrowheart · 02-18-2009, 03:03 PM

When I configure SP and SA manually for an outgoing packet, must the
source IP in SA be the sender (local host)'s IP? Will strongSwan or
native IPsec module check the consistence?

Thanks

Mara · 02-22-2009, 02:58 PM

IMO, yes. Hard to prevent abuses without that.

arrowheart · 02-25-2009, 12:16 AM

Thanks. I thought it is only checked during key negotiation and ignored during transmission.
Actually, I'm wondering if it is necessary to binding the IP address. Actually, if X509 certificates or some other credentials are used during IKE/IKEv2, source IP address is not a big issue any more. Adversaries can spoof IP address but cannot spoof those credentials