Subject: [Ipsec] INTERNAL_IP4_SUBNET and INTERNAL_IP6_SUBNET in IKEv2

From: Ravi Kumar <[email-masked]>
Date: Fri, 10 Sep 2004 10:58:40 +0530

Typically, there can be multiple subnetworks behind Edge 
device (IRAS). I  expect that, IRAC would need to know these 
subnetworks so that it can redirect (by adding appropriate 
routes) the traffic through the tunnel for these networks.

     IRAS can inform these networks via INTERNAL_IPx_SUBNET 
attributes. Isn't the purpose of these attributes? If so, 
why is this attribute not treated as 'Multi-Valued'?

Thanks,
-Ravi

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: "Srinivasa Rao Addepalli" <[email-masked]>
Date: Fri, 10 Sep 2004 10:36:41 -0700

----- Original Message ----- 
From: "Ravi Kumar" <[email-masked]>
To: <[email-masked]>
Sent: Thursday, September 09, 2004 10:28 PM
Subject: [Ipsec] INTERNAL_IP4_SUBNET and INTERNAL_IP6_SUBNET in IKEv2

> why is this attribute not treated as 'Multi-Valued'?

This is not explicitely mentioned in the document. But this is what I think
is intended.
Since, in IKEv2,  multiple Traffic Selectors are possible within
one TS payload, Traffic Selectors are used to represent the internal networks.
Suppose, if there are three internal networks ie 192.168.1.0/24, 192.168.2.0/24
and 192.168.3.0/24, then following TS payloads are sent to the Initiator as 
part of response to AUTH exchange request (Assume that, 192.168.1.10 address
is given to Initiator)

TSi = (0,0-65536, 192.168.1.0-192.168.1.10)
TSr= (  (0, 0-65536, 192.168.1.0-192.168.1.255)
             (0, 0-65536, 192.168.2.0-192.168.2.255)
              (0, 0-65536, 192.168.3.0-192.168.3.255)   

> -Ravi

Intoto Inc.
www.intoto.com