Re: isakmpd and icmp dependencies

[Hakan Olsson <ho@rfc.se>]

On Mon, 8 Sep 2003, Todd Boyer wrote:

> How dependant is isakmpd on being able to echo icmp responses from peers?

isakmpd (i.e the IKE protocol) uses UDP port 500, only. No ICMP.
IPsec uses IP protocol 50 or 51, no ICMP there either.

That said, you can get ICMP responses for various reasons due to these
packets, as always with IP. Any such responses will most likely be ignored
-- there's not much you can do about them, protocolwise. :)

For workarounds, see Cedric Berger's answer about PMTU etc.

/H