Subject: RE: [Ipsec] Easy issues from the IKEv2 clarifications document

From: [email-masked]
Date: Tue, 25 Oct 2005 19:21:06 +0300

Tero Kivinen wrote:

> The IPv6 people said we must have this feature, and I assume they do
> expect it to be used. This is the way IPv6 networks are normally
> configured, so it would be logical to use this method here too.

This is the way IPv6 stateless configuration works, but IKEv2
configuration payloads involve state at the responder, and 
are IMHO closer to DHCPv6 (which doesn't have this functionality).

> Note, that this will automatically give you same IPv6-address when
> connecting to same VPN having only one IPv6 prefix. And it does that
> without any need to remember the address used previously by the
> client, or mapping identities to the same ip-address in the server. 

Some kind of state must be kept while the IKE_SA is alive, of course.

And it may be desirable to maintain state slightly longer than that...
The same address shouldn't be given to some other client too soon
after it has been released; otherwise there can be "interesting"
interactions with flow-related state in the network.

> If some implementation does not support this feature, I would 
> consider that bad IPv6 implementation of IKEv2. 

Well, it looks like not supporting this would simplify implementations 
without removing any useful functionality, so IMHO that sounds
good, not bad...

Best regards,
Pasi

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Francis Dupont <[email-masked]>
Date: Tue, 25 Oct 2005 20:29:40 +0200

=> but DHCPv6 has IA_TA (the functionality is the RFC 3041 one).

=> hold down?

   
=> I have to recall that the privacy protection is a strong requirement
in Europe.

Regards

[email-masked]

---

From: Tero Kivinen <[email-masked]>
Date: Wed, 26 Oct 2005 13:14:00 +0300

> are IMHO closer to DHCPv6 (which doesn't have this functionality).

That feature were added because of the IPv6 people considered it bad
to be like DHCPv6, and wanted it be closer to the stateless
configuration. 

> Some kind of state must be kept while the IKE_SA is alive, of course.

I mean over longer timeperiod, I mean when you disconnect, and come
back 2 weeks later, you will still always get same IP-address. 

> interactions with flow-related state in the network.

There is no point of ever giving the same IP-address to someone else
than to the same client in the IPv6 case. 

> without removing any useful functionality, so IMHO that sounds

It does provide useful functionality. I do consider the stability of
the IP-address (even if the address is dynamic). That feature is in
the IKEv2 already, and it is supposed to be used as I described it. I
just think that as the clarification document adds more examples, it
should be using the example of the desired operation of the protocol
first.  
-- 
[email-masked]