Subject: [Ipsec] 3 modes of defining tunnels in SPD.

From: "mahdavi" <[email-masked]>
Date: Sat, 4 Dec 2004 19:28:34 +0330

Hi Dear Experts. 
I have asked this question before but got no answer. So I ask it again because
we can not decide which is correct. 

the question is as follows. 

I am working on a high speed secure router and there is
something that I cant Understand what to do with it.

and that is these mysterious sentences. (I call these
as Case A and Case B )

"  a. use the value in the packet itself -- This will limit use
      of the SA to those packets which have this packet's value
      for the selector even if the selector for the policy entry
      has a range of allowed values or a wild card for this
      selector.
   b. use the value associated with the policy entry -- If this
      were to be just a single value, then there would be no
      difference between (b) and (a).,......"

Imagine a router that is IPSec aware (SG1).

HOST                                                     HOST
C to K=========|1| SG1 |2|=======================SG2 --- M to X
 |               / \                            /          
 |              /   \                          /            
 \-------------/     \------------------------/          

SG1 has two interfaces 1 and 2 .

outbound policy for interface 2 of SG1 says :

--------------------------------------------------------
For any packet from host (C to k) going to host (M to X)
make a tunnel with SG2. USE CASE B
--------------------------------------------------------

This means to use one SA for all traffic traversing from (C - K) TO ( M - X ).
Right?

What about this policy?

--------------------------------------------------------
For any packet from host (C to k) going to host (M to X)
make a tunnel with SG2. USE CASE A
--------------------------------------------------------

What that means? Does it mean to make separate SA's for any source-destination
pair ?
For example one for a packet traversing from C to M and one another for a
packet giong from D to N and one another for a packet going from C to N  ???

If so what is benefit of this ???
__________________________________________________________
__________________________________________________________
Question 2:

Before, I thought that Case A Is not usable in this situation and
this situation should be used with case b. Was Right ?

__________________________________________________________
__________________________________________________________
Question 3:

Can we have such a policy like below for inbound traffic for interface 1 of SG1?

For inbound traffic for interface 1 of SG1 : (this is just one policy record)

--------------------------------------------------------
For any packet from host (C to k) going to host (M to X)
make a tunnel with ITSELF (SOURCE OF Packet).
--------------------------------------------------------

In above policy because we wanted to have one policy for many tunnels
(in this case 9 tunnels each for each host C - K ) and ITSELF means having a
tunnel with source of packet host.

Firstly, having such a policy is logical???
Secondly, does it mean Case A???

____________________________________________________________

Best of regards
Mahdavi. 
--

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Stephen Kent <[email-masked]>
Date: Mon, 13 Dec 2004 21:38:38 -0500

>and that is these mysterious sentences. (I call these

I would have responded to the first version of your message if it 
were better worded, included specific references to 2401 sections 
that you find confusing, rather than requiring me to find the 
references, etc.

>       difference between (b) and (a).,......"

this text is from section 4.4.1, bottom of page 15. it is describing 
two ways that an SPD entry can be configured, the former is what we 
refer to in 2401bis as "populate from packet."

>Imagine a router that is IPSec aware (SG1).

the correct spelling is IPsec, NOT IPSec, according to 2401, 2402, ...

>C to K=========|1| SG1 |2|=======================SG2 --- M to X

I have no idea what the symbols used here mean, i.e., "C to K" and "M to X."

>This means to use one SA for all traffic traversing from (C - K) TO ( M - X ).

  I assume you are trying to say that you want to support a policy 
that maps all traffic between ANY host behind SG1 to ANY host behind 
SG2 to ONE SA.  Yes, that is a valid policy that can be expressed in 
the SPD.

>What about this policy?

as above, this use of symbols is mysterious, at best.

>If so what is benefit of this ???

one may also configure the SPD so that each pair of hosts, one behind 
each SG, will get a different SA for its traffic. OR, one can have a 
different SA for ALL traffic from one host behind SG1 to ALL hosts 
behind SG2.  There are also options for other granularities of SAs.

I can't parse this sentence.

ibid.

>For inbound traffic for interface 1 of SG1 : (this is just one policy record)

ibid.

>tunnel with source of packet host.

ibid.

>Secondly, does it mean Case A???

ibid.

Steve

---

From: "mahdavi" <[email-masked]>
Date: Tue, 14 Dec 2004 19:40:27 +0330

Hi Steve. 
Thank you for your kind reply and I should appologize for my weak english.

I have reworded my queation as follows:

Consider the following network:

(C - K)-----SG---Internet----(M - X)

SG is an IPsec aware gateway. (C-k) and (M-X) are ranges of hosts 
or gateways. 

Consider the following policy in SG: 

_______________________________________________________
For all incomming traffic from (C-K) going to (M-X) make tunnel 
between SG and the destination of packets. 
_______________________________________________________

Is it a correct policy according to "case a" (from section 4.4.1, bottom of
page 15 from RFC 2401)?

If so, does it means that seperate tunnels between SG and each node in range
(M-X) should be stablished? 

Best regards 
Mahdavi.

---

From: Stephen Kent <[email-masked]>
Date: Thu, 16 Dec 2004 14:13:17 -0500

>Consider the following policy in SG:

A compliant IPsec implementation will let you create an SPD entry 
that matches the "case a" example, what we now call "populate from 
packet" in 2401bis. so, yes, this a valid policy.  (I would not use 
the term "correct" here since whether the policy is correct or not is 
a function of what you want to accomplish.)

>(M-X) should be stablished?

If you populate the SAD entries based on BOTH the source and 
destination addresses, then you will get a distinct SA for each pair 
of communicating hosts in the C-K and M-X ranges.

Steve