Subject: [MSEC] a question about address preservation

From: "QinKe" <[email-masked]>
Date: Tue, 28 Jun 2005 22:04:55 +0800

Dear Brian Weis:

In the document msec9-IETF60-IPsec-Signalatures.pdf, page 7, you proposed possible solutions. You said “Use tunnel encapsulation, but preserve the original addresses”. I am a little confused. If a tunnel is established between two routers A and B, then they will communicate under the protection of the SA that they negotiated. So if an IPsec gateway A preserves the original addresses, after router B recieved packets from router A, he will find the packet's source is original source SRC,NOT A, so how will B finds the correct SPI? I have not read any documents about this Address Preservation. Would you send me a copy or tell me where can I find one? 

                 ------          ------         tunnel          -------
                | SRC  |<=====> |  A   |<====================> |   B   |
                 ------          ------                         -------

　　　　			QinKe
　　　　　　　　[email-masked]
　　　　　　　　　　2005-06-28
_______________________________________________
msec mailing list
[email-masked]
http://six.pairlist.net/mailman/listinfo/msec

---

From: Brian Weis <[email-masked]>
Date: Tue, 28 Jun 2005 13:01:03 -0700

Hi QinKe,

QinKe wrote:
> Dear Brian Weis:
>              
> In the document msec9-IETF60-IPsec-Signalatures.pdf, page 7, you proposed
> possible solutions. You said Use tunnel encapsulation, but preserve the
> original addresses. I am a little confused. If a tunnel is established between
> two routers A and B, then they will communicate under the protection of the SA
> that they negotiated. So if an IPsec gateway A preserves the original
> addresses, after router B recieved packets from router A, he will find the
> packet's source is original source SRC,NOT A, so how will B finds the correct
> SPI? 

The SA lookup on B must follow the rules in Section 4.1 of
draft-ietf-ipsec-rfc2401bis-06.txt.
In some cases, the SA lookup for a multicast packet does not include the
source
address -- only the {SPI, destination} is used for the SA lookup. In
this case, the source
of the packet doesn't matter to IPsec. In other cases {SPI, destination,
source} is used
for the SA lookup. In that case, the group key management protocol must
install the
SA with source=SRC and destination=multicast-address. In this way, B
will find the
correct SPI.

I have not read any documents about this Address Preservation.  Would you
> send me a copy or tell me where can I find one? 

The slide you found is currently the only place this is mentioned. A
document will be
submitted to MSEC soon that will describe Address Preservation more fully.

Brian

> ------------------------------------------------------------------------
> 

-- 
Brian Weis
Advanced Security Development, Security Technology Group, Cisco Systems
Telephone: +1 408 526 4796
Email: [email-masked]
_______________________________________________
msec mailing list
[email-masked]
http://six.pairlist.net/mailman/listinfo/msec