Subject: [Ipsec] clarification on USE_TRANSPORT_MODE Notify

From: Lokesh <[email-masked]>
Date: Thu, 25 Nov 2004 13:03:23 +0530

Hi,
I have a doubt regarding the usage of USE_TRANSPORT_MODE Notify in IKEV2.
if there are two child SA proposals in the SA payload and configuration 
says both should be established in Transport mode should I include two 
USE_TRANSPORT_MODE Notify payloads
one for each SA  in the request message? populating Protocol ID and SPI 
fields of Notify payload
with the protocol and SPI of respective Child SAs?
or the interpretation is other way round like
that the USE_TRANSPORT_MODE Notify does not
in particular applies to a specific child SA proposal being negotiated
in the SA payload, but instead, to whole bunch of all the Child SA
proposals in the SA payload being proposed to responder.
So, we can leave protocol ID and SPI size fields in the Notify Payload Zero.
Hence by this interpretation it clear that all the child SA's should be 
created in Transport
mode if USE_TRANSPORT_MODE notify is honored by responder.

problem with this interpretation would arise only when AH and ESP proposals
configured for a traffic flow are having different encapsulation modes, I 
don't think any implementation would allow such a configuration.

Thanks
Lokesh.

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Thu, 25 Nov 2004 15:48:53 +0200

> don't think any implementation would allow such a configuration.

If I remember right from the RFC2401bis discussion it is now assumed
that AH and ESP are negotiated using the multiple runs through the
IPsec processing (i.e. nested SAs). In this case I would assume they
would be negotiated using separate CHILD_SA exchanges too, so there
would not be any reason to really put part of the SAs tunnel mode and
part to transport mode.
-- 
[email-masked]

---

From: Markku Savela <[email-masked]>
Date: Thu, 25 Nov 2004 16:48:44 +0200

> From: Tero Kivinen <[email-masked]>

> would not be any reason to really put part of the SAs tunnel mode and

I hope you meant, that if we have a packet

   IP1 AH ESP IP2 ...

then

  AH is in transport mode
  ESP is in tunnel mode

That's the only sensible definition. If AH is "tunnel mode" the packet
is faulty, because AH is not followed by IP header!