Subject: [Ipsec] proposal addition in aggresive mode.

From: Someshwar Parate <[email-masked]>
Date: 07 Jan 2005 11:45:34 +0530

Hi all,

Can we add more than one proposal (attribute) in IKE policy to have same
DH group?

============
Actually I am trying to configure IKE policies in out IGATEWAY box and I
am getting following error while adding second proposal

iGateway:/config/ike>add ike B M I -ma 172.16.12.15 -pa 172.16.3.1 -rid
I172.16.3.1 -lid 172.16.12.15 -pfs Y -key 1234567890123456
Policy added successfully

iGateway:/config/ike>addattrib ike 1 M P -k 400 -s 600 -g M768 -e 3DES
-eklen 16
Attribute added successfully

iGateway:/config/ike>addattrib ike 2 M P -k 400 -s 600 -g M768 -e DES
-eklen 16
Error in adding the attribute
ERROR: Atmost One Attribute allowed for an Aggressive Mode Policy.
===============

Does anybody throw any light on this?

thanks and regards...
-- 
Somesh

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Radia Perlman <[email-masked]>
Date: Thu, 06 Jan 2005 22:36:05 -0800

In aggressive mode's first message, Alice sends a Diffie-Hellman value, 
so therefore
has to have already decided on which Diffie-Hellman group she is using. 
She can't
propose others. But she should be able to propose multiple alternatives 
for the other
cryptographic algorithms (prf, encryption, hash)

Radia

---

From: Surya Batchu <[email-masked]>
Date: Thu, 6 Jan 2005 22:57:42 -0800 (PST)

Check this extract from IKE RFC:

"
   Security Association negotiation is limited with
Aggressive Mode. Due
   to message construction requirements the group in
which the Diffie-
   Hellman exchange is performed cannot be negotiated.
"

Since, KE payload is also sent along with SA
proposals, DH group can't be negotiated.

In case of IKEv2, this restriction is not present,
even though both SA and KE happen in the same message.
It has been taken care by different method in IKEv2.

> Can we add more than one proposal (attribute) in IKE

__________________________________ 
Do you Yahoo!? 
Take Yahoo! Mail with you! Get it on your mobile phone. 
http://mobile.yahoo.com/maildemo