Subject: Re: [Mobike] Issue 73: Port numbers in examples

From: "Stephane Beaulieu (stephane)" <[email-masked]>
Date: Mon, 14 Nov 2005 10:58:53 -0500

Hi Pasi,

Thanks.  I meant to follow up with an email, but it slipped my mind.

There's also another piece of text in section 3.5 which is misleading.

<snip>
o  If the IPsec SAs were updated in the previous step: If NAT
      Traversal is not enabled, and the responder supports NAT Traversal
      (as indicated by NAT detection payloads in the IKE_SA_INIT
      exchange), and the initiator either suspects or knows that a NAT
      is likely to be present, enables NAT Traversal (that is, enables
      UDP encapsulation of outgoing ESP packets and sending of NAT-
      Keepalive packets).
<end snip>

This implies that we didn't already switch to port 4500 as was mentioned
earlier in the doc.  My impression is that we were always doing UDP
encaps on port 4500.  (or are we just switching IKE to port 4500, but
not doing UDP encaps?)

Stephane.

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of 
> [email-masked]
> Sent: Monday, November 14, 2005 8:51 AM
> To: [email-masked]
> Subject: [Mobike] Issue 73: Port numbers in examples
> 
> 
> Stephane pointed out in the WG meeting that the examples in 
> Section 2.2 don't change to port 4500 as they should.
> 
> Best regards,
> Pasi
> _______________________________________________
> Mobike mailing list
> [email-masked]
> https://www.machshav.com/mailman/listinfo.cgi/mobike
> 
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Tero Kivinen <[email-masked]>
Date: Mon, 14 Nov 2005 19:52:48 +0200

> encaps on port 4500.  (or are we just switching IKE to port 4500, but

Yes. We simply move all IKE traffic to port 4500 immediately when we
notice that other end supports NAT regardless whether there is NAT or
not. The IPsec SAs are still created using normal ESP packets in case
there is no NAT, and if we move behind NAT then we change those IPsec
SAs to use UDP encapsulation too. If we move away from NAT then we
again disable the UDP encapsulation of IPsec packets, but keep the IKE
traffic on port 4500.

The reason for this is that if we would do the port switch when we
later detect NAT, it would cause the additional complexity, as
responder do not know the addresses that are going to be used in the
encapsulated packets, as initiator wouldn't had sent any packets with
those addresses and NAT wouldn't have created mapping for the packets
yet. 
-- 
[email-masked]
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Jari Arkko <[email-masked]>
Date: Tue, 15 Nov 2005 20:24:51 +0200

I agree with what Tero is writing below. But from
what I understood we are just describing the port
numbers in the example, not adding any other new
text. Correct?

---

From: Tero Kivinen <[email-masked]>
Date: Wed, 16 Nov 2005 11:16:17 +0200

> numbers in the example, not adding any other new

That is my understanding, though I could add something about this to
the design draft under the NAT-T section. 

Something like this at the end of 5.2.3 of the design draft:
----------------------------------------------------------------------
5.2.3.  Moving to behind NAT and back
...
   Enabling NAT-T has few different things, one is to enable the UDP
   encapsulation of ESP packets.  Another is to change the IKE SA ports
   from port 500 to port 4500.  We do not want to do unnecessary UDP
   encapsulation unless there is really a NAT between peers, i.e. it
   should only be enabled when we actually detect NAT.  On the other
   hand as all implementations supporting NAT-T must be able to respond
   to port 4500 all the time, it is simpler from the protocol point of
   view to change the port numbers from 500 to 4500 immediately when we
   detect that other end supports NAT-T.  This way we do not need to
   start changing ports when we detect NAT, which would cause
   complications in the to the protocol.

   If we would do the actual changing of the port only after we detect
   NAT, then the responder would not be able to use the IKE and IPsec
   SAs immediately after their address is changed to be behind NAT, as
   it would need to wait for the next packet from the initiator to see
   what IP and port numbers are used after the initiator changed its
   port from 500 to 4500.  Responder would not also be able to send
   anything to the initiator before the initiator has sent something to
   responder.  If we do the port number changing immediately after the
   IKE_SA_INIT and before IKE_AUTH phase, then we get the rid of this
   problem.
-- 
[email-masked]
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Jari Arkko <[email-masked]>
Date: Wed, 16 Nov 2005 14:40:18 +0200

Ok. --Jari