Subject: [Ipsec] IKEv2 payloads order (N)

From: "Pierrick Caillon" <[email-masked]>
Date: Wed, 15 Aug 2007 15:37:29 +0900

Hello,
 
I am working on IKEv2 protocol, and I face a little issue. I am wondering which payload order to use for the Notify payload.
In the RFC4306, there is nothing said about the placement of the Notify Payload other than in INFORMATIONAL exchanges.
In the RFC4718 (clarification), there is an informative appendix giving some placement for this payload in the other message type.
I first though that I should follow the information from the clarification, but I wonder if I should consider as an error not to have the Notify payload in its proper place.
Maybe I shouln't care of the placement of these payloads, when parsing messages.
 
If anyone has a usefull clue about this, I'll be pleased to read it.
 
Best Regards,
Pierrick Caillon
_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: <[email-masked]>
Date: Wed, 15 Aug 2007 10:07:59 +0300

RFC 4306 does specify the placement of some (but not all) Notify
payloads: e.g. 
NAT_DETECTION_* must be placed after Nr/Ni but before CERTREQ,
COOKIE must be the first payload, REKEY_SA is in the beginning, etc.
 
However, I'd suggest just accepting the payloads in any order, but
sending them 
in the order shown in RFC 4306 and RFC 4718 Appendix A.
 
Best regards,
Pasi

________________________________

	From: ext Pierrick Caillon [mailto:[email-masked]] 
	Sent: 15 August, 2007 09:37
	To: [email-masked]
	Subject: [Ipsec] IKEv2 payloads order (N)

	Hello,
	 
	I am working on IKEv2 protocol, and I face a little issue. I am
wondering which payload order to use for the Notify payload.
	In the RFC4306, there is nothing said about the placement of the
Notify Payload other than in INFORMATIONAL exchanges.
	In the RFC4718 (clarification), there is an informative appendix
giving some placement for this payload in the other message type.
	I first though that I should follow the information from the
clarification, but I wonder if I should consider as an error not to have
the Notify payload in its proper place.
	Maybe I shouln't care of the placement of these payloads, when
parsing messages.
	 
	If anyone has a usefull clue about this, I'll be pleased to read
it.
	 
	Best Regards,
	Pierrick Caillon

---

From: Fukumoto Atsushi <[email-masked]>
Date: Mon, 20 Aug 2007 19:07:29 +0900

Since the issue is raised, I re-read the RFC4718 Appendix A and
draft-hoffman-ikev2bis-01 Appendix C, and I noticed the following:

Figure for IKE_AUTH reply does not have optional INITIAL_CONTACT.  I
think it should since the responder might have crashed while the
initiator does not know it.  Do I need a separate exchange to inform
it?

Figure for CREATE_CHILD_SA exchange does not have optional
CFG_REQUEST/CFG_REPLY, whereas other exchanges have them.

					FUKUMOTO Atsushi
					[email-masked]