Subject: [IPsec] IKE and ESP-tunneled packets when adding/removing NAT

From: <[email-masked]>
Date: Fri, 26 Oct 2007 15:14:45 +0200

IKE SAs and IPsec ESP tunnel SAs have the property, that "hosts 
that are not behind a NAT SHOULD send all packets (including 
retransmission packets) to the IP address and port from the last 
valid authenticated packet from the other end (i.e., dynamically 
update the address)" (quote from RFC 4306, section 2.23,
penultimate paragraph).  This property is described to cover the 
case where a NAT box removes a live mappping.  Thus before the 
mapping was removed, the host not behind a NAT received IKE and 
(UDP encapsulated) ESP packets from address A1 and from UDP port 
P1, but after the mapping was removed and a new created, the IKE 
and (UDP encapsulated) ESP packets come from address A2 and 
from UDP port P2.  In addition, an ESP packet received on an SA 
negotiated by IKE updates not just the ESP tunnel, but also the 
IKE endpoint, which in turn updates all other ESP tunnels 
negotiated by it.

I have wondered, if there is a similar dynamic behavior, if a 
host after receiving normal ESP tunneled packet suddenly begins 
receiving UDP encapsulated ESP packets.  (Or the reverse situation,
when going from receiving UDP encapsulated ESP packet to 
receiving normal ESP tunneled packets.)  Thus, can adding (or 
removing) UDP encapsulation be done at the request of incoming 
packets or is it always done at the request of a mangement 
operation (and so until this management is done, packets are 
dropped)?

For IKE the similar situation means first receiving IKE UDP 
packets on port 500 (sent from address A1), and then change to
reception of IKE UDP packets on port 4500 (sent from address
A2 and perhaps from a port different to 4500).  RFC 4306 
makes the transition from port 500 to port 4500 after the
IKE_SA_INIT, but may this transition take place at any time
during an IKE session?

Christian

_______________________________________________
IPsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: <[email-masked]>
Date: Mon, 29 Oct 2007 11:53:33 +0200

Christian Kaas-Petersen wrote:
> I have wondered, if there is a similar dynamic behavior, if 
> a host after receiving normal ESP tunneled packet suddenly 
> begins receiving UDP encapsulated ESP packets.  (Or the 
> reverse situation, when going from receiving UDP encapsulated 
> ESP packet to receiving normal ESP tunneled packets.)  

No such behavior is defined in RFC 3947, 3948, or 4306;
probably because NATs don't usually appear suddenly in 
the network.

(However, MOBIKE does add/remove UDP encapsulation when
the IP addresses used change.)

<snip>

> IKE_SA_INIT, but may this transition take place at any time

For IKE, such a transition would be unnecessary -- you can
simply send all your IKE messages with port 4500, even when
no NAT is present.

Best regards,
Pasi