Subject: [Ipsec] rfc2401 & rfc2401bis compatability with IKEv1 and IKEv2

From: Surya Batchu <[email-masked]>
Date: Thu, 6 Jan 2005 23:22:40 -0800 (PST)

Hi,

After going through the drafts, it seems that security
policies configured based on rfc2401-bis can only work
with IKEv2 key management.  I guess, rfc2401 specific
policies can work either IKEv1 and IKEv2.

Due to this, I feel that the user configuring the
rfc2401-bis SPD policy, should be aware that the
security gateway that is protecting the remote network
supports IKEv2. Accordingly, these kind of SPD
policies would need to be configured (through
management interface) to use only IKEv2 management.

Is that correct assesment?

Surya

__________________________________ 
Do you Yahoo!? 
Meet the all-new My Yahoo! - Try it today! 
http://my.yahoo.com 

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Stephen Kent <[email-masked]>
Date: Fri, 7 Jan 2005 10:13:10 -0500

>Is that correct assesment?

yes, some of the SPD features in 2401bis require use of IKEv2 to 
negotiate them.  Thus it is desirable that one know whether a peer is 
IKEv2 capable when creating  SPD entries that take advantage of these 
feaures.

Steve

---

From: Shoichi Sakane <[email-masked]>
Date: Fri, 21 Jan 2005 14:42:44 +0900

Hi,

We have to separate a key management protocol from rfc2401-bis.
I am not sure that the rfc2401-bis is written so, but make sure that
the description of parameters or functions required to use IKEv2
should not be "MUST implement it".  Otherwise, an implementer will
inject any of them, then IKEv1 will not work on such implementation.

regards,

---

From: Stephen Kent <[email-masked]>
Date: Fri, 21 Jan 2005 09:57:36 -0500

>inject any of them, then IKEv1 will not work on such implementation.

2401bis implicitly establishes requirements for certain features for 
a key/SA management protocol to enable systems to make full use of 
the IPsec features defined in 2401bis. IKEv2 satisfies these 
requirements; IKE v1 does not. It's way too late to suggest that we 
degrade requirements in 2401bis to be backwards compatible with IKE 
v1.

Steve