From my understanding, for incoming packets over IPSec, the Security Association (SA) is identified by the SPI field of the ESP header.
Then let's say I have a bunch of nodes where each node wants to be able to talk to each other node using IPSec tunnels (so
n nodes, each of which talk to
n-1 other nodes). If that is the case, no SPI value can be used for more than one SA and since there are 2 SAs between each pair of nodes, and since SPI is a 32-bit field, is it correct that there can only be
~65535 nodes in such a configuration?
If so, is there a way to have more nodes in such a configuration? The practicality of this "configuration" is a separate matter.