Subject: [IPsec] subnetted IDcr

From: "Paul Moore" <[email-masked]>
Date: Mon, 5 Jan 2009 11:41:03 -0800

2409 does not specify when you can use subnets in IDcX. This has resulted in a conflict between Windows and racoon

If I define a rule like this

spdadd <your subnet>[21] <yoursubnet> tcp  -P in ipsec esp/transport//require

then racoon send an IDcr of type subnet in the QM exchange. Windows does not like this; (stepping through the code you can see that the first check it makes is that its not v4 or v6 subnet)
It rejects the request.

There is also another failure associated with this. When Windows is the initiator then racoon checks that the IDcr it gets matches what it expects, in this case it still checks against a subnet but Windows sent a concrete address

This is easy to fix in racoon but I copied it to the ipsec group too because the protocol does not really say what IDcX should contain. And I wanted to get consensus about the correct behavior

Note that solaris send concrete adresses

_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 5 Jan 2009 14:12:13 -0800

>2409 does not specify when you can use subnets in IDcX. This has resulted in a conflict between Windows and racoon

You "can use" subnets only when both parties agree to using subnets. You cannot use it when the two parties do not agree to using subnets. This is the main reason we got rid of the different types of address specification in IKEv2.

--Paul Hoffman, Director
--VPN Consortium

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 5 Jan 2009 14:35:22 -0800

At 2:31 PM -0800 1/5/09, Paul Moore wrote:
>I think you are saying that racoon is wrong.

I'm not saying that at all.

>It should not use subnets
>unless it knows (by some of out band mechanism) that the recipient will
>accept them.

Correct.

>And for sure Windows does not accept them

But there is no way for Racoon (or anyone) to know that. For example, some Windows IPsec software (such as the systems we have tested at VPNC) accept subnets just fine.

--Paul Hoffman, Director
--VPN Consortium