Subject: [Ipsec] Multicast SA and local/remote transport selector

From: Markku Savela <[email-masked]>
Date: Mon, 18 Jul 2005 10:52:43 +0300

I've some conceptual difficulties how to deal with SA's for multicast
traffic. Say, I want to specify a policy for specific port of
multicast traffic, and would write a policy

 remote port = X, remote addr = somemulticast -> IPSEC-actions.

As far as I understand, this would result an SA with similar traffic
selector, specifying values for remote parameters.

Now, if the host is also receiving the same multicast traffic, I would
have to speficy another policy line with

  local port = X, local addr = somemulticast -> actions

and would end up with another SA for the same group with different
traffic selectors (local this time).

How is the multicast key management/negotiation going to address this
issue?

In "old times", when my "traffic selectors" in SA were src/dst based,
such multicast SA was not a problem, as it just had

  dst port = X, dst addr = somemulticast

and it works fine for both outgoing and incoming traffic.

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: George Gross <[email-masked]>
Date: Mon, 18 Jul 2005 05:51:52 -0400 (EDT)

Hi Markku,

your question is very timely ;o) I'd suggestion you take a look at the
recently published draft-ietf-msec-ipsec-extensions-00.txt.

This draft is an MSEC working group item, and its intent is to address
questions such as you mention below. The v00 version is abit rushed and
immature, so I would anticipate lots of room for improvement based on
review and comment.

hth,
	George