Subject: [Ipsec] IKEv2 and EAP

From: vamsi <[email-masked]>
Date: Thu, 09 Sep 2004 17:05:32 -0700

Hi,
    Some questions when EAP and IKEv2 are used together.

    EAP model allows Authenticator to be different from Authentication Server.
    Typically RADIUS Server acts as Authentication server.
    IKEv2 responder acts as Authenticator.  IKEv2 initiator is called peer in
    EAP.

    My assumption, when I was going through 2.16 of IKEv2 document is that,
    IKE_AUTH exchange type is used for transferring the EAP payload in IKE.
    I also would assume that 'Response bit' of IKE header is also honored.
    Fortunately, the number of EAP messages, in no retransmission case, are
    always odd.  With first EAP message going as part of response 
from    Authenticator,
    IKE request/response AUTH exchange     works for rest of    EAP messages.

     EAP, itself does retransmissions. Since, IKEv2 provides some sort of
     reliability (with retransmissions), it can be safely assumed that 
between IKE peers,
     messages are not lost. But, messages can be lost during communicating with
     RADIUS or within the Authenticator. In that case, EAP retransmits the 
packet.

     If this happens, the number of EAP messages between IKE peers may not be
     odd. In that case how does Request/Response exchange work?

     Am I on right track so far?

     If so, I can think of two options.

     1.  Don't interpret the 'Response' bit. Always set it as 'Request" and 
no response
          should be expected by the sender.  In this case, IKE is only 
acting as transport
          to send EAP packets between EAP client and EAP Server.

     2.  Have some logic, where IKE  at the Authenticator interprets the 
EAP header and if it is duplicate
          EAP message (which was sent before), then don't send the EAP packet.
          This may require buffering the EAP response so that, it can 
respond to EAP request in case
          of duplicate request.

Comments?

Thanks
Vamsi
www.intoto.com

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Jari Arkko <[email-masked]>
Date: Fri, 10 Sep 2004 11:22:34 +0300

> IKEv2 responder acts as Authenticator.  IKEv2 initiator is called 

Yes.

> always odd.  With first EAP message going as part of response from    
> Authenticator, IKE request/response AUTH exchange works for rest of EAP 
> messages.

Yes.

> messages are not lost.  

That's right. To put it in other words, EAP gives a message for IKEv2
and IKEv2 will either deliver this message, or fail and the whole
connection attempt is abandoned.

> But, messages can be lost during communicating with
> RADIUS or within the Authenticator. In that case, EAP retransmits 
> the packet.

I don't think this is right. AAA protocols have their
own retransmission. If the IKEv2 box does not get an
answer from a RADIUS server, it will retry the Access-Request.
Similarly, if Diameter is used then the underlying TCP/SCTP
protocols handle reliability.

--Jari