Subject: [Ipsec] ICMP and MH TSs for IKEv2

From: Francis Dupont <[email-masked]>
Date: Sat, 03 Sep 2005 01:36:24 +0200

Even with the clarification draft the real world use of traffic selectors
with ICMP type/code or MH (Mobile IPv6 Header message) type is not
very clear:
 - IKEv2 (and IKEv1) establishes SAs by pairs, so if traffic from
   the initiator matches TSi -> TSr then is protected, the traffic
   from the responder which matches TSr -> TSi is protected too.
 - applied to ICMP does this mean that the selected type(s)/code(s) is/are
   protected in both way? (I think so according to the RFC 2401bis 4.4.1
   about SPD-S directionality)
 - the MH type is in the local "port" selector. What is the "local" TS,
   TSi only, or MH type and ICMP type/code are "aligned" (and how)?

Regards

[email-masked]

PS: ipsec-tools seems to put the type in the source port and the code
in the destination port. The RFC 2401bis SPD syntax has 0, 1 or 2 upper
layer protocol items with at most one for ICMP, MH and ICMPv6.

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Markku Savela <[email-masked]>
Date: Sat, 3 Sep 2005 12:19:24 +0300

> From: Francis Dupont <[email-masked]>

>    TSi only, or MH type and ICMP type/code are "aligned" (and how)?

I'm starting to lean on solution, where ICMP/MH type/code's in SA's TS
would always be in both local/remote port (or src/dst port). This way,
even multicast SA's would work without any special handling (an MC SA
that would be used for both receiving and sending).

---

From: Francis Dupont <[email-masked]>
Date: Sat, 03 Sep 2005 12:13:18 +0200

=> I agree this solution seems good but it was only suggested and only
for ICMP in the clarifications I-D.

Thanks