Subject: RE: [Ipsec] INTERNAL_IP6_SUBNET and multiple prefixes

From: [email-masked]
Date: Fri, 18 Feb 2005 13:39:17 +0200

In draft-eronen-ipsec-ikev2-clarifications-00 my preliminary
conclusion was that the INTERNAL_IP4/6_SUBNET attributes do 
not make sense in CFG_REQUESTs. 

If the responder wants to send one or more INTERNAL_IP4/6_SUBNET
attributes, it should do so, regardless of whether the initiator 
asked for them or not (the initiator will ignore them if it has 
no use for them). This case is also shown in the example in 
Section 2.19.

(It looks like the sentence "Multiple sub-networks MAY be
requested" was copied verbatim from the MODE-CFG draft from
1999, but no longer makes sense. Or at least that's my
current interpretation -- other comments are certainly welcome.)

Best regards,
Pasi

> -----Original Message-----
> From: Vijay Devarapalli
> Sent: Thursday, February 17, 2005 10:32 PM
> To: [email-masked]
> Subject: [Ipsec] INTERNAL_IP6_SUBNET and multiple prefixes
> 
> 
> hi all,
> 
> how does the initiator ask for information on multiple IPv6 
> prefixes by using the INTERNAL_IP6_SUBNET attribute?
> 
> section 3.15.1 says
> 
>        o  INTERNAL_IP6_SUBNET - The protected sub-networks that
>           this edge-device protects.  This attribute is made up 
>           of two fields; the first being a 16 octet IPv6 address 
>           the second being a one octet prefix-length as defined 
>           in [ADDRIPV6].  Multiple sub-networks MAY be requested.  
>           The responder MAY respond with zero or more sub-network 
>           attributes.
> 
> the INTERNAL_IP6_SUBNET seems to have a fixed length of 21 (4
> + 17 for value) octets. I guess the responder could send
> information about multiple IPv6 prefixes by including multiple
> INTERNAL_IP6_SUBNET attributes in the the CFG_REPLY
> payload. but how does the initiator indicate whether it wants
> information about one IPv6 prefix or all the IPv6 prefixes? or
> the does the responder by default send information about all
> the IPv6 prefixes?
> 
> Vijay

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Vijay Devarapalli <[email-masked]>
Date: Fri, 18 Feb 2005 11:33:59 -0800

> not make sense in CFG_REQUESTs. 

hmm.. but what if the initiator does not want to know about
the prefixes?

IMO, the initiator should include the INTERNAL_IP6_SUBNET
attribute in CFG_REQUEST and the responder should just send
information on all prefixes.

> no use for them). This case is also shown in the example in 

okay.

> current interpretation -- other comments are certainly welcome.)

should this be fixed during AUTH48 edits?

we just need to remove "Multiple sub-networks MAY be requested."
and say the responder always sends information on all prefixes?

Charlie?

Vijay