Subject: [Mobike] Changing to port 4500

From: Eric Fung <[email-masked]>
Date: Tue, 29 Aug 2006 15:23:54 -0400

RFC 4555, Sec. 3.3 says that if both peers support MOBIKE and NAT-T, then they 
must change to port 4500 even if NAT was not detected between them.

But in the design document, RFC 4621, Sec 5.2.3 says that the port change 
should be done immediately after IKE_SA_INIT and before IKE_AUTH. However, 
support for MOBIKE is declared during the IKE_AUTH exchange.

I suppose it's not a big deal, since peers will be listening on port 4500 
anyway. But when should the initiator and responder change ports in the 
scenario where there is no NAT between them?
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Tero Kivinen <[email-masked]>
Date: Wed, 30 Aug 2006 10:27:10 +0300

Eric Fung writes:
> RFC 4555, Sec. 3.3 says that if both peers support MOBIKE and NAT-T,
> then they must change to port 4500 even if NAT was not detected
> between them.

Yes. 

> support for MOBIKE is declared during the IKE_AUTH exchange.

RFC4555 does the same. If you check the example in section 2.2 you see
that initiator changes to the port 4500 immediately after IKE_SA_INIT.
It knows at that point that the other end supports NAT-T (the other
end sent NAT_DETECTION_*_IP notifications) and it knows it supports
MOBIKE, so he does the change at that point, even when he is not sure
if the other end supports MOBIKE. 

> scenario where there is no NAT between them?

RFC 4621 and RFC 4555 agree on that, i.e. IKE_AUTH is already done on
port 4500. 

RFC 4621 is more clear as it says we change to port 4500 immediately
upon detecting that the other end supports NAT-T (this implicitly also
says that we support NAT-T and MOBIKE).

The RFC 4555 has a bit underspecified text saying we change if both
ends supports both, but actually we do not need to  know whether
remote end supports MOBIKE, knowing that it supports NAT-T is
enough. Anyways examples make it very clear that we change to port
4500 for the IKE_AUTH.
-- 
[email-masked]
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike