Subject: [Ipsec] IKEv2 and OPAQUE protocol

From: Scott C Moonen <[email-masked]>
Date: Tue, 13 Feb 2007 12:32:23 -0700

Hi, I am reading RFCs 4301, 4306 and have a question regarding 
interpretation.  RFC 4301 stipulates that SPD entries and SAs may cover 
OPAQUE port values, in case of non-initial packet fragments where the 
ports are unknown.  In the case of IPv6, it also stipulates support for 
OPAQUE protocol values in SPD entries and SAs, since the IPv6 protocol is 
not known in non-initial fragments (and might not be known in the first 
fragment).  I understand that IKEv2 specifies an OPAQUE port value using 
the special port range [65535, 0].  However, I cannot determine how IKEv2 
specifies an OPAQUE protocol value, since protocol ranges are not 
supported.

I found a few notes on this list from November 2004 referencing this 
problem, but without any resolution.  RFC 4718 doesn't reference this 
problem.

The inability to specify an OPAQUE protocol value seems to be a deficiency 
in the IKEv2 specification relative to the requirements of RFC 4301.  Am I 
missing something?  If not, how are various IKEv2 implementations 
approaching the use of OPAQUE protocol values in combination with SAs?

Thanks in advance,

Scott Moonen ([email-masked])

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec