Subject: [Ipsec] Intent of couple of attributes in Configuration Payload in IKEv2?

From: "Shekhar Kshirsagar" <[email-masked]>
Date: Thu, 18 Nov 2004 15:33:35 -0800

IKEv2 draft defines following two attributes in Configuration payload:
INTERNAL_IP4_NETMASK
INTERNAL_IP4_SUBNET 

Why will IRAC need the netmask - won't just address be enough? 

Also, when is explicit SUBNET attribute required? My understanding was that protected Sub-networks will be communicated as part of TS.

Shekhar

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: "Srinivasa Rao Addepalli" <[email-masked]>
Date: Thu, 18 Nov 2004 19:16:17 -0800

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Shekhar Kshirsagar
Sent: Thursday, November 18, 2004 3:34 PM
To: [email-masked]
Subject: [Ipsec] Intent of couple of attributes in Configuration Payload
inIKEv2?

Also, when is explicit SUBNET attribute required? My understanding was that
protected Sub-networks will be communicated as part of TS.

SRINI> typically, the protected subnets configured (INTERNAL_IP4_SUBNETs)
AND subnet represented by INTENREAL_ADDRESS+INTERNAL_NETMASK would be sent
as TSi and TSr by the IRAS to the IRAC. But, in theory, the selectors could
be different from these protected networks. For example, selector range can
be 10.0.0.0 to 10.255.255.255 and protected subnetworks can be subnets
within them. This kind of flexibility is really needed in IKEv1 as only one
selector can be exchanged in one quick mode. In IKEv2, TSi and TSr can be
same as protected networks as IKEv2 supports multiple Traffic selectors.

SRINI>Separating TS configuration from protected networks offers one more
advantage of providing some sort of access control. Based on type of user
requesting the IP address, varying traffic selectors can be sent for the
same protected network. Users with higher privileges can be given access to
all resources in the protected network. Users with different privilege can
be given access to only some set of machines in the protected network.
Similarly, based on the type of user, the type of services that the user can
access in protected networks can be controlled using separate traffic
selector configuration.

Shekhar

---

From: Tero Kivinen <[email-masked]>
Date: Fri, 19 Nov 2004 11:52:04 +0200

Shekhar Kshirsagar writes:
> Also, when is explicit SUBNET attribute required? My understanding
> was that protected Sub-networks will be communicated as part of TS. 

the TS payloads include the part of the subnets on the other hand,
i.e. the ones which are accessable through this SA. The SUBNETs
attribute should include all subnets, i.e. it can also include subnets
which are not accessable with the IPsec SA created now, but which
require separate SA to be created to them.

I.e. the server might have configuration where it has two subnets
10.2.3.0/24 and 10.2.6.0/24 which is serves out to the clients. It can
also have policy which says that each of those subnets needs to be
carried through separate SA because of the policy reason. So when
client first contacts and gives TSr having two entries
10.2.6.6-10.2.6.6 and 0.0.0.0-255.255.255.255 (the first matching the
actual data in the packet), the server can reply with the TSr
10.2.6.0-10.2.6.255, and with configuration payload SUBNETs listing
both 10.2.3.0/24 and 10.2.6.0/24. This way client can know that it can
reach 10.2.3.0 also throught the gateway, but he needs to create
separate SA for it.
-- 
[email-masked]

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Fri, 19 Nov 2004 12:32:46 -0800

Tero,

> reach 10.2.3.0 also throught the gateway, but he needs to create

Wow! Is this common knowledge ?  Does this mean the IKev2 spec
is underspecified for these ? How can one possibly infer this from the
IKev2 spec ? 

-mohan

---

From: Tero Kivinen <[email-masked]>
Date: Mon, 22 Nov 2004 13:28:53 +0200

Mohan Parthasarathy writes:
> Wow! Is this common knowledge ?

Yes, I think it is.

> Does this mean the IKev2 spec is underspecified for these ?

I do not think so.

> How can one possibly infer this from the IKev2 spec ?

The IKEv2 spec is quite clear how to format TS and SUBNETs listing. It
does also specify how they are used (TS = selectors for this SA,
SUBNETS = all subnets accessable through this gateway), so I think it
is simply obvious how to use them together, even when it is not
explicitly mentioned in the document. 
-- 
[email-masked]