Subject: [Ipsec] Configuration payload and traffic selectors

From: "Ravi Prasad" <[email-masked]>
Date: Tue, 28 Jun 2005 15:51:50 +0530

Hi,

Assume the scenario where a remote host connects to internet through his
corporate gateway.

To do this a CP payload (CFG_REQUEST with INTERNAL_ADDRESS attribute of
type IPv4) is included as part of CREATE_CHILD_SA message.

The draft says that 

"The CP payload MUST be inserted before the SA payload.
 In variations of the protocol where there are multiple IKE_AUTH
exchanges, the CP payloads 
  MUST be inserted in the messages containing the SA payloads."
 
There is no issue in building SA payload. I have doubt on how to build
Traffic selectors TSi? 
The draft(draft-ietf-ipsec-ikev2-17.txt sec 2.9) says that
"The first of the two TS payloads is known as TSi (Traffic Selector-
initiator).  The second is 
  known as TSr (Traffic Selector-responder). TSi specifies the source
address of traffic forwarded 
  from (or the destination address of traffic forwarded to) the
initiator of the CHILD_SA pair."
 
In this case what will be my TSi?
Is it the local address in the remote network? Or is it wild card
address?
 
Thanks and Regards
Ravi prasad

#####################################################################
This Email Message is for the sole use of the intended recipient(s) and May contain CONFIDENTIAL and PRIVILEGED information.
LG Soft India will not be responisible for any viruses or defects or
any forwarded attachements emanating either from within
LG Soft India or outside. Any unauthorised review , use, disclosure or distribution is prohibited. If you are not intentded
recipient, please contact the sender by reply email and destroy all
copies of the original message.
#####################################################################

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Tue, 28 Jun 2005 16:50:07 +0300

In section 2.19 (page 34 in draft -17) there is an example with a  
universal TSi (= (0,0-65536,0.0.0.0-255.255.255.255) )
In its response, the responder narrows it down to the assigned IP  
address (in the example, (0,0-65536,192.0.2.202-192.0.2.202) )

On Jun 28, 2005, at 1:21 PM, Ravi Prasad wrote:

>
> Hi,
> Assume the scenario where a remote host connects to internet through  
> his corporate gateway.
> To do this a CP payload (CFG_REQUEST with INTERNAL_ADDRESS attribute  
> of type IPv4) is included as part of CREATE_CHILD_SA message.
>  
> The draft says that
> “The CP payload MUST be inserted before the SA payload.
>   MUST be inserted in the messages containing the SA payloads.”
>  
> “The first of the two TS payloads is known as TSi (Traffic Selector-  
> initiator of the CHILD_SA pair.”
>  
> This Email Message is for the sole use of the intended recipient(s)  
> and May contain CONFIDENTIAL and PRIVILEGED information.
> LG Soft India or outside. Any unauthorised review , use, disclosure or  
> distribution is prohibited. If you are not intentded
> #####################################################################__ 
> _____________________________________________
> Ipsec mailing list
> [email-masked]