Subject: [IPsec] SCTP Multihoming with IPSec (RFC 3554)

From: Bhaskar Dutta <[email-masked]>
Date: Thu, 27 Aug 2009 12:49:36 +0530

Hi,

Does any IPSec implementation support RFC 3554 (On the Use of Stream Control

Transmission Protocol (SCTP) with IPsec)?

I am working on SCTP over IPSec (linux 2.6.27) and in case of multihoming
unless
RFC 3554 is supported I will need to configure 2 * n * m Security
Associations.

TIA.

Regards,
Bhaskar

---

From: Tero Kivinen <[email-masked]>
Date: Thu, 27 Aug 2009 15:13:57 +0300

> Transmission Protocol (SCTP) with IPsec)?

Yes. Altough I do not know if it has been really tested (mostly just
using sctp_test and single pair of ip-addresses).

> RFC 3554 is supported I will need to configure 2 * n * m Security

With IKEv2 you should just create one SA having multiple source and
destination addresses. Then if more addresses are later added you need
to create new SA with all of the addresses (or just new addresses). 
-- 
[email-masked]

---

From: Bhaskar Dutta <[email-masked]>
Date: Thu, 27 Aug 2009 18:53:25 +0530

> to create new SA with all of the addresses (or just new addresses).

Thanks a lot!

I looked up for examples on setting up sainfo entries in racoon's
remote.conf with
 multiple source/destination addresses but the man pages or searching the web
did not lead to anything. Couldnt even find any examples with multiple
entries in sainfo.

Do you have any idea on how to write the sainfo entries in remote.conf
and spdadd entries
in setkey.conf that will work with multiple source/dest addresses?

I did write to the ipsec-tools-users list but no luck yet.

Thanks,
Bhaskar

---

From: Raj Singh <[email-masked]>
Date: Thu, 27 Aug 2009 22:36:35 +0530

Hi Bhasker,

This document will help you:
http://www.ipsec-howto.org/ipsec-howto.pdf
*It has sample configs for racoon.

*Thanks & Regards,
Raj

On Thu, Aug 27, 2009 at 6:53 PM, Bhaskar Dutta <[email-masked]> wrote:

> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec
>

---

From: Bhaskar Dutta <[email-masked]>
Date: Fri, 28 Aug 2009 08:16:52 +0530

On Thu, Aug 27, 2009 at 10:36 PM, Raj Singh<[email-masked]> wrote:
> It has sample configs for racoon.
>
> Thanks & Regards,
> Raj

Hi Raj,

I'd already gone through this howto as well as several others. I
couldn't find _anything_
that contains configuration examples for specifying multiple addresses
in a single SA
(which is the requirement for SCTP over IPSec RFC).

As Tero pointed out, the support is there, but he doubts if any real
testing has been
done. Once I figure out how to specify the configuration with
ipsec-tools I am planning
to test it out thoroughly.

Thanks,
Bhaskar

---

From: Tero Kivinen <[email-masked]>
Date: Fri, 28 Aug 2009 14:51:43 +0300

> to test it out thoroughly.

I talked only about our own implementation (quicksec), not about any
other implementation. You asked if "any implemention" supports it, so
I replied to that.

I have no idea whether some other implementation than our own supports
SCTP. 
-- 
[email-masked]