Subject: [Ipsec] Multiple instances of INTERNAL_IP4/6_ADDRESS

From: Vijay Devarapalli <[email-masked]>
Date: Mon, 16 Jul 2007 16:19:12 -0700

Hello,

I have a question on the use of multiple instances of the 
INTERNAL_IP4_ADDRESS and INTERNAL_IP6_ADDRESS attributes in the same 
configuration payload. RFC 4306 says the following.

          Multiple
          internal addresses MAY be requested by requesting multiple
          internal address attributes.  The responder MAY only send up to
          the number of addresses requested.

Do all these addresses have to be from the same subnet/prefix? It seems 
so, but I wanted to confirm.

In case they can be from different subnets/prefixes, what do you set the 
TSi to? TSi can only include a range of addresses, not a bunch of 
addresses from different subnets/prefixes.

Thanks in advance.

Vijay

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: <[email-masked]>
Date: Wed, 18 Jul 2007 15:12:56 +0300

Vijay Devarapalli wrote:
 
> INTERNAL_IP4_ADDRESS and INTERNAL_IP6_ADDRESS attributes in 
> the same configuration payload. RFC 4306 says the following.
> 
>           Multiple
>           internal address attributes.  The responder MAY 
>           only send up to the number of addresses requested.
> 
> Do all these addresses have to be from the same 
> subnet/prefix? It seems so, but I wanted to confirm.

I don't think they have to be from the same subnet/prefix (and
especially in case of IPv4, the client will not usually even know
where the subnet boundaries are).

> In case they can be from different subnets/prefixes, what do you set
> the TSi to? TSi can only include a range of addresses, not a bunch
> of addresses from different subnets/prefixes.

TSi *can* actually include a bunch of ranges (see e.g. RFC 4718
Section 4.7), so the answer could look something like this:
   
   CP(CFG_REPLY) =
     INTERNAL_IP4_ADDRESS(192.0.1.66)
     INTERNAL_IP4_ADDRESS(10.0.1.2)
   TSi = ((0, 0-65535, 192.0.1.66-192.0.1.66),
          (0, 0-65535, 10.0.1.2-10.0.1.2)),
   TSr = (0, 0-65535, 0.0.0.0-255.255.255.255)

Best regards,
Pasi

---

From: Vijay Devarapalli <[email-masked]>
Date: Wed, 18 Jul 2007 08:28:45 -0700

>    TSi = ((0, 0-65535, 192.0.1.66-192.0.1.66),

Thanks, I wasn't aware of this.

I guess then we can use the multiple addresses simultaneously
through the same IPsec tunnel SA. You can use the different
addresses for different flows. This is an interesting "feature". :)

Vijay