Subject: RE: [Ipsec] Easy issues from the IKEv2 clarifications document

From: [email-masked]
Date: Tue, 25 Oct 2005 16:54:07 +0300

Tero Kivinen wrote:
> It would be good to have this default format as a first example, 
> i.e:
> 
>      CP(CFG_REQUEST) =
>        INTERNAL_IP6_ADDRESS(::20f:1fff:fe12:4749)
>        INTERNAL_IP6_DNS()
>      TSi = (0, 0-65535, 
>             :: -           FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF)
>      TSr = (0, 0-65535,
>             :: - FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF)
> 
>      CP(CFG_REPLY) =
>        INTERNAL_IP6_ADDRESS(2001:DB8::20f:1fff:fe12:4749/64)
>        INTERNAL_IP6_DNS(2001:DB8:99:88:77:66:55:44)
>      TSi = (0, 0-65535, 2001:DB8::20f:1fff:fe12:4749 -
>   		    2001:DB8::20f:1fff:fe12:4749)
>      TSr = (0, 0-65535, :: - 
>                 FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF)
> 
> I.e. the client sends the 64 lower bits of the address, and the 
> server will fill the prefix. 

Do you expect that implementations will actually use this feature?
My guess would be that clients don't really care what interface
identifier they get, and will be happy to let the gateway choose...

(Except when they're also requesting also a particular prefix; 
i.e., the same address they had previously.)

Best regards,
Pasi

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Tue, 25 Oct 2005 17:17:27 +0300

> identifier they get, and will be happy to let the gateway choose...

The IPv6 people said we must have this feature, and I assume they do
expect it to be used. This is the way IPv6 networks are normally
configured, so it would be logical to use this method here too.

Note, that this will automatically give you same IPv6-address when
connecting to same VPN having only one IPv6 prefix. And it does that
without any need to remember the address used previously by the
client, or mapping identities to the same ip-address in the server. 

If some implementation does not support this feature, I would consider
that bad IPv6 implementation of IKEv2. 
-- 
[email-masked]

---

From: Francis Dupont <[email-masked]>
Date: Tue, 25 Oct 2005 19:03:41 +0200

=> in fact for privacy reasons some should exactly get any address
but never the same one. As systems assigning addresses can try to
provide stable addresses, mainly because it is the right thing when
there is no privacy considerations, IMHO this feature will be used
so should be documented in the example.

Regards

[email-masked]

PS: cf RFC 3041 for privacy and interface IDs.

---

From: Vijay Devarapalli <[email-masked]>
Date: Tue, 25 Oct 2005 12:10:57 -0700

section 5.3.2 of 
http://www.ietf.org/internet-drafts/draft-ietf-mip6-bootstrapping-split-01.txt
might be relevant here.

we discussed this quite a bit in the MIP6 WG and the
conclusion was whats written in section 5.3.2. we
decided to introduce a new attribute MIP6_HOME_PREFIX
to first obtain the home prefix length and then
auto-configure a home address.

Vijay