Subject: Re: [Ipsec] Clarifications open issue: INTERNAL_IP4_SUBNET/NETMASK

From: Vijay Devarapalli <[email-masked]>
Date: Wed, 04 May 2005 15:58:39 -0700

hi Pasi,

I interpreted this in a different way for IPv6. IMO, the
INTERNAL_IP6_SUBNET attribute should contain the prefix that
corresponds to the IPv6 prefix from which the address
returned in the INTERNAL_IP6_ADDRESS attribute is configured
from.

Vijay

ps: we already had a discussion on this off list, but I thought
it would be a good idea to get comments from others.

[email-masked] wrote:
> Hi everyone,
> 
> One of the open issues in the IKEv2 clarifications draft
> concerns INTERNAL_IP4_SUBNET and INTERNAL_IP4_NETMASK
> attributes. We already had some discussion about these on the
> list earlier, but I'd like to check if others think our
> interpretation is roughly correct:
> 
> - INTERNAL_IP4_SUBNET in CFG_REPLY means roughly that "in
>   my (responder's) opinion, you should send traffic to these
>   addresses through me".  If these addresses are not included in
>   TSr, obviously we need to create additional SAs.  And if TSr
>   includes other addresses (e.g. is 0.0.0.0-255.255.255.255) 
>   it means that the client can (but does not have to), if 
>   permitted by its own policy, do "split tunneling" (only 
>   send the traffic listed in INTERNAL_IP4_SUBNETs via the 
>   gateway, but other traffic directly).
> 
> - Including INTERNAL_IP4_SUBNET in CFG_REQUEST is not 
>   absolutely necessary: if the responder has this information, 
>   it can send it anyway (as shown in the example in ikev2-17 
>   Section 2.19). But if INTERNAL_IP4_SUBNET is included in 
>   CFG_REQUEST, other lengths than zero don't make sense.
> 
> - The address blocks listed in INTERNAL_IP4_SUBNET do not have
>   to match physical link boundaries. For instance, if the whole
>   B class block 130.233.0.0/16 is behind the gateway, it's
>   enough to send a single INTERNAL_IP4_SUBNET attribute (rather
>   than listing all the /24s or whatever sized subnets that
>   organization uses).
>   
> - INTERNAL_IP4_NETMASK does not make much sense, and should not
>   be used (or it means the same thing as INTERNAL_IP4_SUBNET,
>   and in that case, it's preferable to use INTERNAL_IP4_SUBNET).
> 
> draft-eronen-draft-eronen-ipsec-ikev2-clarifications-02.txt
> actually has almost four pages of text about these payloads,
> so especially if you disagree with our current opinion (which
> is open to change, BTW), please check that, too!
> 
> Best regards,
> Pasi
> 
> _______________________________________________
> Ipsec mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/ipsec

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec