Subject: [Ipsec] Re: Replicated identities

From: "Srinivasa Rao Addepalli" <[email-masked]>
Date: Wed, 26 Jan 2005 10:48:24 -0800

In general, it is not good allow reuse of identities by multiple remote users. But, yet times, it is necessary to allow reuse of identities to simplify the configuration. It is also necessary that simplification of configuration should not degrade the security. Typically, it is useful in cases where there is some other mechanism to identify and authenticate the user. L2TPoIPsec is one such case. In this case, as part of PPP, users are authenticated and identified. 

There is also a need to allow one user to access internal network via VPN tunnel from different machines simultaneously with or without L2TPoIPsec. In this case, VPN security gateway would see multiple IKE sessions with the same identity. Even though this is one valid deployment scenario, there is no simple way to distinguish between a single user making multiple IKE sessions Vs different users using the same identity. This need to be kept in mind in allowing replicated identities by administrator. Also, note that, if replicated identities are allowed, administrator may not get accounting related information on per user basis. To disallow multiple users using same identity, administrator can employ identity specific preshared keys. 

As you have indicated, there are some issues allowing multiple IKE sessions with the same identity and they need to be handled properly. Some implementations provide configuration facility to allow the reuse of identities as part of their VPN configuration. Ensure that, the implementations handle INITIAL_CONTACT message properly. One simple way, some implementation implemented is to ignore INITIAL_CONTACT notification message, if administrator configure it to allow replicated identities.
I feel, this will not have any significant effect, if DPD is negotiated in case of IKEv1. In IKEv2, IKE SA live-check is mandatory and no issue there.
Due to this liveness checks, there will not be any problem of excessive assignment of IRAS IP addresses to the same IRAC. 

Srini

➢ In IPsec drafts and standards, there is no explicit prohibition of reusing the identity by remote access clients. 
➢ It seems to me that, there was an implicit understanding that each peer uses its own and unique identity.
➢  Now, we have a need to support multiple remote access sessions using the same identitiy. 
➢ Some of the issues I can see are with INITIAL-CONTACT and assignment of internal IP address
➢ (virtual IP address) to the clients.

➢ What are the other technical&deployment issues in allowing duplicate identities from IKE based 

➢ remote access clients?

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec