IPSec and mis-ordered frames

[brian.holmes]

How does Cisco's IPSec implementations handle mis-ordered frames? Does it simply drop, re-order them or pass them for decryption. ( IPSec sequence # coming in out of order)

Sent from Cisco Technical Support iPhone App

[manish arora]

Two IPSec peers can send millions of packets, a  64-packet sliding window is implemented to bound the amount of memory  required to tally the receipt of a peer's packets. Packets can arrive  out of order, but they must be received within the scope of the window  to be accepted. If they arrive too late (outside the window), they are  dropped.

Manish

[brian.holmes]

Does Cisco VPN clients for Windows/Mac also implement a 64 packet window?

Sent from Cisco Technical Support iPhone App

[manish arora]

Not sure about VPN client etc , but i think  that this should apply to every device using ESP encryption as this is in accordance with the RCF 2401  that provides some sort of packet integerity.

check this out for more detail :-

http://www.cisco.com/en/US/docs/solutions/Enterprise/WAN_and_MAN/QoS_SRND/IPSecQoS.html#wp56337

Manish

[brian.holmes]

Thanks for the pointer...I see the example in appendix C of the RFC

Sent from Cisco Technical Support iPhone App