# Maximum number of nodes with IPSec?

From my understanding, for incoming packets over IPSec, the Security Association (SA) is identified by the SPI field of the ESP header.

Then let's say I have a bunch of nodes where each node wants to be able to talk to each other node using IPSec tunnels (so n nodes, each of which talk to n-1 other nodes). If that is the case, no SPI value can be used for more than one SA and since there are 2 SAs between each pair of nodes, and since SPI is a 32-bit field, is it correct that there can only be ~65535 nodes in such a configuration?

If so, is there a way to have more nodes in such a configuration? The practicality of this "configuration" is a separate matter.

• An SA is uniquely identified by both a SPI as well as a Destination Address. This means that you could theoretically have a single SPI for multiple destination nodes that would still uniquely be identified. This would increase the number of nodes that could be connected. Sep 14, 2014 at 21:39
• I thought about that but because of an unusual situation, the addresses might change frequently, so using the dest/src address isn't reliable. Sep 15, 2014 at 11:43
• What unusual situation? This configuration in general is unusual, and at a minimum impractical. Sep 15, 2014 at 12:20
• Well, I would still like to have the original question answered, regardless of how how unusual/impractical it is. Let's call it an educational question. Sep 15, 2014 at 12:55
• That's cool, I'm just curious as to what unusual situation makes the destination IP unreliable. Sep 15, 2014 at 13:00

The math...32 bits.

2^32 / 2 != 65535

2^32 = 4,294,967,296
4,294,967,296 / 2 = 2,147,483,648

You don't get IPSec without IP and IP defines a source and destination address in every packet. You'll always have a source/destination with each of our SAs.

That means your limit is 4,294,967,296 or 2,147,483,648 per IP address you communicate with because your software can keep track of the SA assigned to each IP.