Subject: RE: [Ipsec] Is it mandatory to have the incoming and outgoing SAprotocol and encryption/auth algorithms same?

From: "Gandhar Gokhale" <[email-masked]>
Date: Fri, 9 Jun 2006 16:08:57 +0530

Does IKE negotiation not put this restriction automatically? As far as I
remember there's no facility of negotiating inbound and outbound
protocols separately. 
BTW, what is the use case for such an asymmetry?

Thanks and regards,
Gandhar Gokhale

-----Original Message-----
From: Poorna Pushkala B [mailto:[email-masked]] 
Sent: Friday, June 09, 2006 4:03 PM
To: [email-masked]
Subject: [Ipsec] Is it mandatory to have the incoming and outgoing
SAprotocol and encryption/auth algorithms same?

Hi,
I am relatively new to ipsec.  
Is it mandatory to have the incoming and outgoing Security Association
protocol (AH/ESP) and encryption/auth algorithms same?
I went through RFC 2401, though it defines a Security Association, it is
not clear if for a given VPN tunnel, the incoming and outgoing SAs
should use the same protocol ( AH/ESP).

Can you help me? 

Thanks & Regards
Kala. B

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: "Poorna Pushkala B" <[email-masked]>
Date: Fri, 9 Jun 2006 16:20:14 +0530

Hi,
Thanks for your reply. Say I want a tunnel where I want all incoming traffic
to be encrypted whereas outgoing traffic to be just authenticated and not
encrypted?

Thanks & Regards
Kala

On 6/9/06, Gandhar Gokhale <[email-masked]> wrote:
> remember there's no facility of negotiating inbound and outbound protocols
> separately. BTW, what is the use case for such an asymmetry?     Thanks
> and regards, Gandhar Gokhale
>
> *From:* Poorna Pushkala B [mailto:[email-masked]]
> *Sent:* Friday, June 09, 2006 4:03 PM
> *To:* [email-masked]
> *Subject:* [Ipsec] Is it mandatory to have the incoming and outgoing
> not clear if for a given VPN tunnel, the incoming and outgoing SAs should
> use the same protocol ( AH/ESP).
>
> Can you help me?
>
> Thanks & Regards
> Kala. B
>
>

---

From: Markku Savela <[email-masked]>
Date: Fri, 9 Jun 2006 14:22:40 +0300

> Thanks for your reply. Say I want a tunnel where I want all incoming
> traffic to be encrypted whereas outgoing traffic to be just
> authenticated and not encrypted?

IKE has the limitation/simplification that symmetric SA's are
used. The only way to get asymmetric is to use manual keys or some
other private key negotiation (if your IPsec implementation can
express asymmetric policy for inbound and outbound).