Subject: Understanding of ipsp-xxx-mib's

From: Maxim Frolov <[email-masked]>
Date: Fri, 4 Mar 2005 11:00:33 +0100

Hallo,

I'm evaluating IPSec SPD, IPsec action and IKE action MIBs to employ 
them as an appropriate (implementation independent) IPsec policy 
language / format for IPsec capable security devices developed by our company.

I have some questions about these MIB's.

Q1. Understanding question
	After reading RFC3585, RFC3586, ipsp-ipsecpib, ipsp-spd-mib, 
	ipsp-ipsecaction-mib and ipsp-ikeaction-mib I can do the following
	statements:
	1. RFC3585 is an informational model that decsribes how an 
		IPSec SPD is to be logically constructed. This is a 
		hint for concrete implementations of IPSec SPD formats/languages.
	2. The ipsp WG has proposed two implementations of IPSec SPD based on RFC3585:
		a) ipsp-ipsecpib
		b) ipsp-spd-mib, ipsp-ipsecaction-mib and ipsp-ikeaction-mib

        Are these statements rougly true?

Q2. About ipsp-ikeaction-mib objects:
	How references a IpiaIkeActionEntry a IpiaIkeActionProposalsEntry?
	
	How references a IpiaIkeActionProposalsEntry one or more contained 
	IpiaIkeProposalEntry's?
	
	I found references to ipiaAhTransformTable, ipiaEspTransformTable and 
	ipiaIpcompTransformTable but no definitions of them. Are they from and shared 
	with ipsp-ipsecaction-mib?

Q3. Example of an IPsec rule.
	I would like to define a SPD rule which will have filter for some trafic 
	and which should cause IKE negotation of a IPSec SA by which the traffic 
	will be encrypted. To realize this I would create at first a spdRuleDefinitionEntry
	and define spdRuleDefFilter. But what action or actions should this rule point to?
	As the IPsec SA negotioation should be performed two actions are required:
	1. IKE action to create IKE SA
	2. IPsec action to create IPsec SA
	Should the spdRuleDefAction point to a entry from SpdCompoundActionTable which
	constsis of a IpiaIpsecActionEntry and a IpiaIkeActionEntry?	

Maxim Frolov.

---

From: Robert Story <[email-masked]>
Date: Sat, 5 Mar 2005 07:56:42 -0500

On Fri, 4 Mar 2005 11:00:33 +0100 Maxim wrote:
MF> Q1. Understanding question
MF> 	After reading RFC3585, RFC3586, ipsp-ipsecpib, ipsp-spd-mib, 
MF> 	ipsp-ipsecaction-mib and ipsp-ikeaction-mib I can do the following
MF> 	statements:
MF> 	1. RFC3585 is an informational model that decsribes how an 
MF> 		IPSec SPD is to be logically constructed. This is a 
MF> 		hint for concrete implementations of IPSec SPD formats/languages.
MF> 	2. The ipsp WG has proposed two implementations of IPSec SPD based on
MF> 	RFC3585:
MF> 		a) ipsp-ipsecpib
MF> 		b) ipsp-spd-mib, ipsp-ipsecaction-mib and ipsp-ikeaction-mib
MF> 
MF>         Are these statements rougly true?

sounds about right to me.

MF> Q2. About ipsp-ikeaction-mib objects:
MF> 	How references a IpiaIkeActionEntry a IpiaIkeActionProposalsEntry?

There is no direct reference. The IpiaIkeActionProposalsTable uses the
ipaIkeActname from the IpiaIkeActionTable as the first index. So once the ike
action is created, create proposals with the same name as the first index, and
a unique priority as the second index.

MF> 	How references a IpiaIkeActionProposalsEntry one or more contained 
MF> 	IpiaIkeProposalEntry's?

There is a direct link here. The ipiaIkeActPropName contains the name of an ike
proposal in the ipiaIkeProposalTable.

MF> 	I found references to ipiaAhTransformTable, ipiaEspTransformTable and 
MF> 	ipiaIpcompTransformTable but no definitions of them. Are they from and
MF> 	shared with ipsp-ipsecaction-mib?

They are in the IPSEC-POLICY-MIB. There are 3 MIBs, and they all work together.

MF> Q3. Example of an IPsec rule.
MF> 	I would like to define a SPD rule which will have filter for some
MF> 	trafic and which should cause IKE negotation of a IPSec SA by which the
MF> 	traffic will be encrypted. To realize this I would create at first a
MF> 	spdRuleDefinitionEntry and define spdRuleDefFilter. But what action or
MF> 	actions should this rule point to? As the IPsec SA negotioation should
MF> 	be performed two actions are required: 1. IKE action to create IKE SA
MF> 	2. IPsec action to create IPsec SA
MF> 	Should the spdRuleDefAction point to a entry from
MF> 	SpdCompoundActionTable which constsis of a IpiaIpsecActionEntry and a
MF> 	IpiaIkeActionEntry?	

Sounds about right.

Here is an overview of the MIBs that I put together. It may help you out.

	http://net-policy.sourceforge.net/tutorial/mib2/index.html

---

From: Maxim Frolov <[email-masked]>
Date: Mon, 7 Mar 2005 17:13:08 +0100

Hello Robert,

thank you very much for response!

> They are in the IPSEC-POLICY-MIB. There are 3 MIBs, and they all work
I was first exposed that these three MIBs are ipsp-spd-mib, 
ipsp-ipsecaction-mib and ipsp-ikeaction-mib which are result of splitting of 
one big IPSEC-POLICY-MIB.
What are other two MIBs which work with IPSEC-POLICY-MIB together?
I have not found ipiaAhTransformTable in the IPSEC-POLICY-MIB also.
(I mean ipiaAhTransformTable, NOT ipspAhTransformTable).

Maxim.