Subject: [Ipsec] About case A and Case B?

From: "mahdavi" <[email-masked]>
Date: Tue, 30 Nov 2004 20:15:40 +0330

I am working on a high speed secure router and there is
 something that I cant Understand what to do with it. 

and that is these mysterious sentences. (I call these 
as Case A and Case B )

 "  a. use the value in the packet itself -- This will limit use
       of the SA to those packets which have this packet's value
       for the selector even if the selector for the policy entry
       has a range of allowed values or a wildcard for this
       selector.
    b. use the value associated with the policy entry -- If this
       were to be just a single value, then there would be no
       difference between (b) and (a).,......"

Imagine a router that is IPSec aware (SG1). 

HOST                                                     HOST
C to K=========|1| SG1 |2|=======================SG2 --- M to X
  |               / \                            /           
  |              /   \                          /            
  \-------------/     \------------------------/          

SG1 has two interfaces 1 and 2 . 

outbound policy for interface 2 of SG1 says :

--------------------------------------------------------
For any packet from host (C to k) going to host (M to X) 
make a tunnel with SG2. USE CASE B 
--------------------------------------------------------

This means to use one SA for all traffic traversing from (C - K) TO ( M - X ).
Right? 

What about this policy? 

--------------------------------------------------------
For any packet from host (C to k) going to host (M to X) 
make a tunnel with SG2. USE CASE A 
--------------------------------------------------------

What that means? Does it mean to make separate SA's for any source-destination
pair ?
For example one for a packet traversing from C to M and one another for a
packet giong from D to N and one another for a packet going from C to N  ???

If so what is benefit of this ??? 
__________________________________________________________
__________________________________________________________
Question 2: 

Before, I thought that Case A Is not usable in this situation and 
this situation should be used with case b. Was Right ? 

__________________________________________________________
__________________________________________________________
Question 3: 

Can we have such a policy like below for inbound traffic for interface 1 of SG1?

For inbound traffic for interface 1 of SG1 : (this is just one policy record)

--------------------------------------------------------
For any packet from host (C to k) going to host (M to X) 
make a tunnel with ITSELF (SOURCE OF Packet). 
--------------------------------------------------------

In above policy because we wanted to have one policy for many tunnels 
(in this case 9 tunnels each for each host C - K ) and ITSELF means having a
tunnel with source of packet host. 

Firstly, having such a policy is logical??? 
Secondly, does it mean Case A??? 

____________________________________________________________

Best of regards 
Mahdavi. 

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec