Subject: [Ipsec] INTERNAL_IP6_SUBNET and multiple prefixes

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 17 Feb 2005 12:32:00 -0800

hi all,

how does the initiator ask for information on multiple IPv6 prefixes
by using the INTERNAL_IP6_SUBNET attribute?

section 3.15.1 says

       o  INTERNAL_IP6_SUBNET - The protected sub-networks that this
          edge-device protects.  This attribute is made up of two fields;
          the first being a 16 octet IPv6 address the second being a one
          octet prefix-length as defined in [ADDRIPV6].  Multiple
          sub-networks MAY be requested.  The responder MAY respond with
          zero or more sub-network attributes.

the INTERNAL_IP6_SUBNET seems to have a fixed length of 21 (4 + 17 for
value) octets. I guess the responder could send information about
multiple IPv6 prefixes by including multiple INTERNAL_IP6_SUBNET
attributes in the the CFG_REPLY payload. but how does the initiator
indicate whether it wants information about one IPv6 prefix or all the
IPv6 prefixes? or the does the responder by default send information
about all the IPv6 prefixes?

Vijay

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Fri, 18 Feb 2005 16:14:58 -0800

Vijay,

> attributes in the the CFG_REPLY payload. but how does the initiator

Something related to INTERNAL_IP6_SUBNET was discussed before.
It is not the only way to return the IPv6 prefixes. You can also use
the traffic selector payloads to return the prefixes. This means that the SA you
just established can be used access the prefixes sent back in the TSr (normal
IKEv2 semantics). If you use INTERNAL_IP6_SUBNET, it tells the client that
what subnets are behind the SG (usually needed by the client to implement
split tunneling), but you need to establish separate SAs for
accessing them. If at all we end up fixing something here, it might be worth
clarifying this.

-mohan