Subject: Re: [Ipsec] Intent of couple of attributes in Configuration Payload inIKEv2?

From: "Shekhar Kshirsagar" <[email-masked]>
Date: Fri, 19 Nov 2004 07:28:43 -0800

Thanks, that clarifies part of my question.

If IRAS provides explicit list of accessable networks through SUBNET attribute, why is NETMASK attribute required? Isn't it redundant? 

Shekhar
>>> Tero Kivinen <[email-masked]> 11/19/04 01:52 AM >>>
Shekhar Kshirsagar writes:
> Also, when is explicit SUBNET attribute required? My understanding
> was that protected Sub-networks will be communicated as part of TS. 

the TS payloads include the part of the subnets on the other hand,
i.e. the ones which are accessable through this SA. The SUBNETs
attribute should include all subnets, i.e. it can also include subnets
which are not accessable with the IPsec SA created now, but which
require separate SA to be created to them.

I.e. the server might have configuration where it has two subnets
10.2.3.0/24 and 10.2.6.0/24 which is serves out to the clients. It can
also have policy which says that each of those subnets needs to be
carried through separate SA because of the policy reason. So when
client first contacts and gives TSr having two entries
10.2.6.6-10.2.6.6 and 0.0.0.0-255.255.255.255 (the first matching the
actual data in the packet), the server can reply with the TSr
10.2.6.0-10.2.6.255, and with configuration payload SUBNETs listing
both 10.2.3.0/24 and 10.2.6.0/24. This way client can know that it can
reach 10.2.3.0 also throught the gateway, but he needs to create
separate SA for it.
-- 
[email-masked]

________________________________________________________________________
This email has been scanned for computer viruses.

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec