Subject: RE: [Ipsec] Configuration payload and traffic selectors

From: "Ravi Prasad" <[email-masked]>
Date: Tue, 28 Jun 2005 19:47:48 +0530

Hi,

Just correct me if I am wrong.

I thought that there will be two TSi and TSr's. One with CP payload and
one for the child SA.

I mean some thing like this

IKE_AUTH =   {HDR, SK {IDi, [CERT,] [CERTREQ,]  [IDr,] AUTH, 

             CP(CFG_REQUEST), TSi, TSr /* This TSi and TSr are for the
CP payload */

             SAi2, TSi, TSr}  /* This TSi and TSr are for the Child SA
payload */

U means to say that   IKE_AUTH    is like this                   

IKE_AUTH =   {HDR, SK {IDi, [CERT,] [CERTREQ,]  [IDr,] AUTH, 

             CP(CFG_REQUEST), 

             SAi2, TSi, TSr}  /* This TSi and TSr are for the Child SA
payload */

The TSi  and TSr referred CP payload below 

       "  For example, message from initiator to responder:

                 CP(CFG_REQUEST)=

                        INTERNAL_ADDRESS(0.0.0.0)

                       INTERNAL_NETMASK(0.0.0.0)

                      INTERNAL_DNS(0.0.0.0)

              TSi = (0, 0-65536,0.0.0.0-255.255.255.255)

             TSr = (0, 0-65536,0.0.0.0-255.255.255.255)"

are to be sent with SA payload for child SA creation. They are not part
of CP(CFG_REQUEST). CP (CFG_REQUEST) is like this

CP(CFG_REQUEST)=

                        INTERNAL_ADDRESS(0.0.0.0)

                       INTERNAL_NETMASK(0.0.0.0)

                      INTERNAL_DNS(0.0.0.0)

Kindly email whether my understanding is correct.

Thanks and regards

Ravi Prasad

 

________________________________

From: Srinivas V. Chakravarty 
Sent: Tuesday, June 28, 2005 6:24 PM
To: Ravi Prasad
Subject: RE: [Ipsec] Configuration payload and traffic selectors

Hi,

Please refer to the section 2.19 in the draft-ietf-ipsec-ikev2-17.txt.

For example, message from initiator to responder:

      CP(CFG_REQUEST)=

        INTERNAL_ADDRESS(0.0.0.0)

        INTERNAL_NETMASK(0.0.0.0)

        INTERNAL_DNS(0.0.0.0)

      TSi = (0, 0-65536,0.0.0.0-255.255.255.255)

      TSr = (0, 0-65536,0.0.0.0-255.255.255.255)

The initiator specifies the possible range of addresses. The responder
would set a particular ( or may be range?) to the Tsi value in its
response. Look at the response,

      CP(CFG_REPLY)=

        INTERNAL_ADDRESS(192.0.2.202)

        INTERNAL_NETMASK(255.255.255.0)

        INTERNAL_SUBNET(192.0.2.0/255.255.255.0)

      TSi = (0, 0-65536,192.0.2.202-192.0.2.202)

      TSr = (0, 0-65536,192.0.2.0-192.0.2.255)

Regards,

Srinivas Chakravarty

________________________________

From: [email-masked] [mailto:[email-masked]] On Behalf
Of Ravi Prasad
Sent: Tuesday, June 28, 2005 3:52 PM
To: [email-masked]
Subject: [Ipsec] Configuration payload and traffic selectors

Hi,

Assume the scenario where a remote host connects to internet through his
corporate gateway.

To do this a CP payload (CFG_REQUEST with INTERNAL_ADDRESS attribute of
type IPv4) is included as part of CREATE_CHILD_SA message.

The draft says that 

"The CP payload MUST be inserted before the SA payload.
 In variations of the protocol where there are multiple IKE_AUTH
exchanges, the CP payloads 
  MUST be inserted in the messages containing the SA payloads."
 
There is no issue in building SA payload. I have doubt on how to build
Traffic selectors TSi? 
The draft(draft-ietf-ipsec-ikev2-17.txt sec 2.9) says that
"The first of the two TS payloads is known as TSi (Traffic Selector-
initiator).  The second is 
  known as TSr (Traffic Selector-responder). TSi specifies the source
address of traffic forwarded 
  from (or the destination address of traffic forwarded to) the
initiator of the CHILD_SA pair."
 
In this case what will be my TSi?
Is it the local address in the remote network? Or is it wild card
address?
 
Thanks and Regards
Ravi prasad

#####################################################################
This Email Message is for the sole use of the intended recipient(s) and
May contain CONFIDENTIAL and PRIVILEGED information.
LG Soft India will not be responisible for any viruses or defects or
any forwarded attachements emanating either from within
LG Soft India or outside. Any unauthorised review , use, disclosure or
distribution is prohibited. If you are not intentded
recipient, please contact the sender by reply email and destroy all
copies of the original message.
#####################################################################
#####################################################################
This Email Message is for the sole use of the intended recipient(s) and May contain CONFIDENTIAL and PRIVILEGED information.
LG Soft India will not be responisible for any viruses or defects or
any forwarded attachements emanating either from within
LG Soft India or outside. Any unauthorised review , use, disclosure or distribution is prohibited. If you are not intentded
recipient, please contact the sender by reply email and destroy all
copies of the original message.
#####################################################################

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Tue, 28 Jun 2005 17:13:23 +0300

I could be wrong, but I think there's just one TSi payload, and one TSr 
payload.

On Jun 28, 2005, at 5:17 PM, Ravi Prasad wrote:

> I thought that there will be two TSi and TSr’s. One with CP payload 
> and one for the child SA.
>        “  For example, message from initiator to responder:
>                  CP(CFG_REQUEST)=
>              TSr = (0, 0-65536,0.0.0.0-255.255.255.255)”
>  
> are to be sent with SA payload for child SA creation. They are not 
> part of CP(CFG_REQUEST). CP (CFG_REQUEST) is like this
> CP(CFG_REQUEST)=
> Assume the scenario where a remote host connects to internet through 
> his corporate gateway.
> To do this a CP payload (CFG_REQUEST with INTERNAL_ADDRESS attribute 
> of type IPv4) is included as part of CREATE_CHILD_SA message.
>  
> The draft says that
> “The CP payload MUST be inserted before the SA payload.
>   MUST be inserted in the messages containing the SA payloads.”
>  
> “The first of the two TS payloads is known as TSi (Traffic Selector- 
> initiator of the CHILD_SA pair.”
>  
> This Email Message is for the sole use of the intended recipient(s) 
> and May contain CONFIDENTIAL and PRIVILEGED information.
> This Email Message is for the sole use of the intended recipient(s) 
> and May contain CONFIDENTIAL and PRIVILEGED information.