Subject: RE: [Ipsec] Will ikev2-16 be the charm?

From: "Charlie Kaufman" <[email-masked]>
Date: Wed, 22 Sep 2004 14:17:32 -0700

No, I somehow lost track of your fixes. I'm going to be doing one more
draft for this and to get rid of Alice and Bob.

Did I miss anything else?

	--Charlie

-----Original Message-----
From: Tero Kivinen [mailto:[email-masked]] 
Sent: Monday, September 20, 2004 6:36 AM
To: Charlie Kaufman
Cc: [email-masked]; [email-masked]; [email-masked]; Barbara Fraser
Subject: [Ipsec] Will ikev2-16 be the charm?

Charlie Kaufman writes:
> I have a revised I-D for IKEv2 ready to go unless someone tells me not
> to submit it. The first two changes below motivated the revision. The
> others respond to recent discussions on the list and some IESG
comments
> that I had misplaced.
...
> 9) 3 minor editorial clarifications.

Did those include fixing the section 3.15.1 table so that
INTERNAL_IP?_SUBNETS are multivalued?

Hmm... my mail (<[email-masked]>)
included 4 changes, with first one changing text in 2 places. Which
one of those were included?
-- 
[email-masked]

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Thu, 23 Sep 2004 06:29:33 +0200

In section 3.15.1, the Attribute Type is said to be 7 bits, although 
the diagram shows that it is 15 bits.

---

From: Jyothi <[email-masked]>
Date: Fri, 24 Sep 2004 07:56:01 +0530

Hi all,

I have some issues in selection of traffic selectors in IKEv2.

Initially, SG1 and SG2 have the same SPD configuration.
  After that SG2 administrator modified the SPD policy but SG1 SPD policy 
is not modified.

           H1 -------SG1 ---- Internet ------ SG2-----H2

SG1 SPD policy:
      Protocol: ALL

      Src 1:  1.1.1.10 - 1.1.1.200
      Src 2:  2.2.2.20 - 2.2.2.40

      Dst 1:  10.10.10.10 - 10.10.10.20
      Dst 2:  20.20.20.20 - 20.20.20.200

SG2 SPD policy:
      Protocol: ALL

      Src 1:  20.20.20.50 - 20.20.20.100
      Src 2:  10.10.10.5 - 10.10.10.15

      Dst 1:  1.1.1.10 - 1.1.1.30
      Dst 2:  2.2.2.10 - 2.2.2.30

H1 IP address is : 1.1.1.15   H2 IP address is : 20.20.20.65

Traffic initiated from H1 to H2 (UDP traffic with port 6666 to destination 
port 6767)
There are three cases:
1) No PFP is set

     SG1 started negotiating IKEv2 with following traffic selectors:

         TS Src1:  1.1.1.15 protocol UDP port 6666 (pkt selectors may be 
sent or may not be (renewal case)).
            Src2:  1.1.1.10 - 1.1.1.200
            Src3:  2.2.2.20 - 2.2.2.40

         TS Dst1:  20.20.20.65 protocol UDP port 6767
            Dst2:  10.10.10.10 - 10.10.10.20
            Dst3:  20.20.20.20 - 20.20.20.200

     What SG2 should select?? Because it has some matching selectors??

Can SG2 select the following selectors and send it to SG1:

a)
         TS Src1: 1.1.1.10 - 1.1.1.30 (is a subset of the received selectors
                                        and SPD policy has the same set)
            Src2: 2.2.2.20 - 2.2.2.30 (is a subset of the received selectors
                                       adn SPD policy has a set more than 
that subset)

         TS Dst1: 20.20.20.50 - 20.20.20.200 (is a subset of the received 
selectors
                                                and SPD policy has the same 
set)
            Dst2: 10.10.10.10 - 10.10.10.15(is a subset of the received 
selectors
                                                and SPD policy has the same 
set)
    protocol is ALL

If IPSEC SA are created with the above set, there will be overhead.
Searching is happening twice.
Can I store multiple sets of selectors in SA??

I think I am missing some thing. Please correct me.

                         OR
b) Can I just select the packet selectors and protocol ALL (since the SPD 
policy has
          protocol ALL configuration).

2) PFP is selected for protocol and IP addresses in SG1, but not in SG2.

Then in this case what SG1 should propose??

Is it pkt selectors and SPD selectors with a particular protocol??

3) PFP is not selected in SG1, but in SG2.

In this case what selectors SG2 should select??

If SG2 selects the matching subset, same SA will be used even if PFP is 
selected.

Thanks
Jyothi

---

From: Tero Kivinen <[email-masked]>
Date: Fri, 24 Sep 2004 11:17:56 +0300

>             Dst2: 10.10.10.10 - 10.10.10.15(is a subset of the received 

Yes, it can select that. 

> Can I store multiple sets of selectors in SA??

Yes. 

>           protocol ALL configuration).

Yes protocol can be ALL if you like, as initiator offered it, and
responder allows that in the policy. 

> Then in this case what SG1 should propose??

SG1 will then propose

    TS Src1: 1.1.1.15 protocol UDP
       Dst1: 20.20.20.65 protocol UDP

And the responder must return that same TS, as there is nothing it can
limit the TS. 

> In this case what selectors SG2 should select??

SG1 will offer same thing as in 1), and the SG2 will select the same
thing that SG1 selected in the 2), i.e. the first TS entry, which is
the one matching the packet. 
-- 
[email-masked]

---

From: "William Dixon" <[email-masked]>
Date: Fri, 24 Sep 2004 09:10:21 -0700

This is just the tip of the iceberg. We need a place to document selector
negotiation in order to achieve reliable interop. A BCP draft seems
reasonable, unless we are worried about people not implementing some parts
of the negotiation and we want to mandate it as MUST for interop. Thoughts
Tero ?

> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Tero Kivinen
> Sent: Friday, September 24, 2004 1:18 AM
> To: Jyothi
> Cc: [email-masked]
> Subject: [Ipsec] Traffic selectors selection using IKEv2
> 
> Jyothi writes:
> > SG1 SPD policy:
> >       Protocol: ALL
> > b) Can I just select the packet selectors and protocol ALL 
> (since the 
> > SPD policy has
> Yes protocol can be ALL if you like, as initiator offered it, 
> and responder allows that in the policy. 
> 
> And the responder must return that same TS, as there is 
> nothing it can limit the TS. 
> 
> SG1 will offer same thing as in 1), and the SG2 will select 
> the same thing that SG1 selected in the 2), i.e. the first TS 
> entry, which is the one matching the packet. 
> --
> [email-masked]
>

---

From: "Srinivasa Rao Addepalli" <[email-masked]>
Date: Wed, 29 Sep 2004 15:25:35 -0700

Hi all,

  Initially, SG1 and SG2 have the same SPD configuration.
   After that SG2 administrator modified the SPD policy but SG1 SPD policy is not modified.

  SG1 SPD policy:
       Protocol: ALL

  SG2 SPD policy:
       Protocol: ALL

  Traffic initiated from H1 to H2 (UDP traffic with port 6666 to destination port 6767)
  There are three cases: 
  1) No PFP is set 

          TS Src1:  1.1.1.15 protocol UDP port 6666 (pkt selectors may be sent or may not be (renewal case)).
             Src2:  1.1.1.10 - 1.1.1.200
             Src3:  2.2.2.20 - 2.2.2.40

  a)
          TS Src1: 1.1.1.10 - 1.1.1.30 (is a subset of the received selectors
                                         and SPD policy has the same set)
             Src2: 2.2.2.20 - 2.2.2.30 (is a subset of the received selectors
                                        adn SPD policy has a set more than that subset)

          TS Dst1: 20.20.20.50 - 20.20.20.200 (is a subset of the received selectors
                                                 and SPD policy has the same set)
             Dst2: 10.10.10.10 - 10.10.10.15(is a subset of the received selectors
                                                 and SPD policy has the same set)
     protocol is ALL

  SRINI> Yes. This seems to be correct.

  SRINI> Since, you are sending all possible selectors in the response,
  only one SA is needed and all selected selectors point to the same SA.

                          OR
  b) Can I just select the packet selectors and protocol ALL (since the SPD policy has
           protocol ALL configuration).

  SRINI> This scheme would create too many SAs and I would not recommend this.

  SRINI> If SG1 is initiator, it would send specific protocol and specific IP addresses.
  Responder will select the same thing. 

  If SG2 selects the matching subset, same SA will be used even if PFP is selected.

  SRINI> SG1 as initiator would send all selector ranges including the packet selectors. SG2 would select
  the packet selectors as its response. If packet selectors are not sent (typically happens during start up
  or in case of persistent tunnel configurations), then this negotiation would fail. 

  Thanks
  Jyothi 

------------------------------------------------------------------------------

  Intoto Inc.
  www.intoto.com