Hot answers tagged

5

Cisco has a nice IPSec Overhead calculator (CCO Login required, unfortunately). https://cway.cisco.com/ipsec-overhead-calculator/ From where we can draw, based on your IPSec settings and a few common optionals thrown in: 8 PPPoE (optional, but widespread) 20 outer IP header 8 NAT-T (optional, widespread, sometimes even default-on) 8 ESP Header (4 SPI ...


1

I found the answer further above in page 16 of RFC7296 There is no need to send a notification payload regarding a different IKE SA. The current IKE SA is already in the IKE header. The first of these paragraphs in section 3.10 says "the SPI is included only with INVALID_SELECTORS, REKEY_SA, and CHILD_SA_NOT_FOUND". Section 1.3.2 on page 16 makes ...


Only top voted, non community-wiki answers of a minimum length are eligible