Subject: RE: [Mobike] RE: [Ipsec] Asymmetric Security

From: <[email-masked]>
Date: Tue, 15 Feb 2005 09:35:27 -0500

Hi Steve,

Response inline.

Atul

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]]On
> Behalf Of ext Stephen Kent
> Sent: Monday, February 14, 2005 11:55 PM
> To: Sharma Atul (Nokia-ES/Boston)
> Cc: [email-masked]; [email-masked]; [email-masked]
> Subject: [Mobike] RE: [Ipsec] Asymmetric Security
> 
> 
> At 9:10 AM -0500 2/14/05, <[email-masked]> wrote:
> >Thanks Yoav, for bringing another scenario needing 
> Asymmetric support.
> >More such scenarios we can bring the better.
> >
> >The question is whether IKEv2 and 2401bis are sufficient to handle
> >the Asymmetric Security needs or do we need something extra? Things
> >like:
> >	Do we allow different tunnel endpoints in the two direction of
> >	a tunnel?
> 
> this is not a well-formed question; a tunnel is composed of two SAs. 
> what do you  mean to ask here?

I will make it more explicit, with one example scenario:
	So let us say SA pair has the SAs: SA1, SA2. The gateways X and Y.
	For the sake of simplicity let us just have Y multihomed with addresses
	Y1 and Y2. So for SA1 tunnel endpoints are X and Y1, for SA2 tunnel
	endpoints are Y2 and X.

Is something like this allowed now?

> >	Do we allow IKE negotiations to be asymmetric?
> 
> again, not well-formed. are you referring to anything other than S/D 
> addresses? how about ports?

In the above example, IKE in forward direction go X->Y1, but comeback 
Y2->X. 

Is that allowed? As far as I know, it is not allowed.
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Stephen Kent <[email-masked]>
Date: Tue, 15 Feb 2005 10:59:52 -0500

>Is something like this allowed now?

I think my other message addressed this question, but frankly the 
text above is very unclear. try explaining it again.

>Is that allowed? As far as I know, it is not allowed.

so, if I understand your question, it is whether a multi-homed SG can 
accept IKE packets on one interface and send them back via the other 
interface, labelled with the source address of the second interface. 
My guess is that IKE would not react well to this. Note that IKE SAs 
do not share all the features of ESP or AH SAs. In ESP or AH, we 
tolerate the situation in which the source address for an inbound 
packet either is irrelevant to processing (for the outer address in 
tunnel mode) or we can accommodate multiple valid source addresses 
(for transport mode or the inner address in tunnel mode, if 
configured in the SPD).

Steve