Subject: RE: [Ipsec] Question about "narrowing" ...

From: "Michael Roe" <[email-masked]>
Date: Fri, 11 Feb 2005 12:45:02 -0000

Markku Savela writes: 
> The conclusion here: either policies must match exactly so that
> narrowing never occurs, or if policies are not quite matching as in
> above, BOTH sides must be using decorrelated policies and reflect this
> in already in their offers?
> 
> Seems that IKEv2 would need to know whether other side is using
> decorrelated policies or not?
> 
> Remember: decorrelation is not mandatory by 2401bis!

I'd noticed this, too.

There seems to be a risk of negotiating an SA that doesn't work
(some packets sent on it will be rejected by the receiver) unless:

(a) The decorrelated SPD is sent in the traffic selectors
or
(b) The responder has some magic means (outside of IKEv2) of
    knowing the contents of the initiator's SPD. One way to
    do this would be to have a vendor-specific protocol that
    runs before IKEv2, does the actual negotiation, and creates
    an SPD that IKEv2 can use ... and if you're doing this, you don't
    need narrowing.  Another way to do this is for the sysadmins of
    the two ends to have a telephone call and spend a couple of hours
    debugging their SPDs.

I think the decorrelated SPD entry ought to be sent in the traffic
selectors.

Mike

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec