Subject: [IPsec] Issue #175: Better wording for NAT mobility issues

From: Paul Hoffman <[email-masked]>
Date: Thu, 4 Feb 2010 17:45:38 -0800

The last bullet in 2.23 is confusing. A proposed rewrite is:

Old:

There are cases where a NAT box decides to remove mappings that are
still alive (for example, the keepalive interval is too long, or the
NAT box is rebooted).  To recover in these cases, hosts that do not
support other methods of recovery such as MOBIKE [MOBIKE], and that
are not behind a NAT, SHOULD send all packets (including
retransmission packets) to the IP address and port from the last
valid authenticated packet from the other end (that is, they should
dynamically update the address).  A host behind a NAT SHOULD NOT do
this because it opens a possible denial of service attack.  Any
authenticated IKE packet or any authenticated UDP- encapsulated ESP
packet can be used to detect that the IP address or the port has
changed.  When IKEv2 is used with MOBIKE, dynamically updating the
addresses described above interferes with MOBIKE's way of recovering
from the same situation.  See Section 3.8 of [MOBIKE] for more
information.

New:

There are cases where a NAT box decides to remove mappings that are
still alive (for example, the keepalive interval is too long, or the
NAT box is rebooted). This will be apparent to a host if it receives
a packet whose integrity protection validates, but has a different
port, address, or both from the one that was associated with the SA
in the validated packet. When such a validated packet is found, a
host that does not support other methods of recovery such as MOBIKE
[MOBIKE], and that is not behind a NAT, SHOULD send all packets
(including retransmission packets) to the IP address and port in the
validated packet, and SHOULD store this as the new address and port
combination for the SA (that is, they SHOULD dynamically update the
address). A host behind a NAT SHOULD NOT do this type of dynamic
address update if a validated packet has different port and/or
address values because it opens a possible denial of service attack
(such as allowing an attacker to break the connection with a single
packet). When IKEv2 is used with MOBIKE, dynamically updating the
addresses described above interferes with MOBIKE's way of recovering
from the same situation.  See Section 3.8 of [MOBIKE] for more
information.

--Paul Hoffman, Director
--VPN Consortium