But should you reject unauthenticated connections just because they
have ID which you are not authenticating anyways.
Yes I think so. You are changing the meaning of ID from implicitely
"verified ID" to potentially "unverified ID". I think that is wrong.
But what prevent you from throwing away ID content in this case,
as you know that it is unauthenticated (you may even not to log it),
and allow user to connect? User has already exposed the
content of ID, the damage (if any) has already occured,
so what you will you protect by rejecting the connection?
Regards,
Valery.
Paul
_______________________________________________
IPsec mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/ipsec
