Subject: [IPsec] IPv6 Address resolution on IPsec node

From: "Thamilarasu Kandasamy (thamil)" <[email-masked]>
Date: Tue, 13 Apr 2010 14:06:10 +0530

IPv6 nodes use Neighbor Discovery messages for address resolution as
defined in RFC 4861.  However on an IPv6 node having IPsec
implementation, if there is an SPD entry with a selector that covers all
IP traffic, Neighbor Discovery messages could potentially be discarded
(especially during system reload) and IKE negotiation be initiated.  But
this would eventually fail as the node haven't yet determined the
link-layer address for the given IPv6 address.  The RFC 4301 is not
explicit about  according any 'special' treatment to Neighbor Discovery
messages.  Like in case of IKE messages, we shall make provisions for ND
messages to bypass IPsec protection?  Would appreciate feedback/comments
from the working group!

Thanks

Thamil

---

From: Tero Kivinen <[email-masked]>
Date: Wed, 14 Apr 2010 18:00:48 +0300

> messages to bypass IPsec protection?  Would appreciate feedback/comments

RFC4301 says that all kind traffic goes through SPD, including
management traffic , which includes also IPsec management traffic such
as IKE. 

This means that your SPD needs to explictly have passby rules for
local management traffic, i.e. things like dhcp, neighbor discovery,
router advertisement, router solication, IKE (both IPv4, and IPv6, and
both normal IKE, and NAT-T IKE port).

So all of those rules should be like just normal IPsec SPD rules, they
should not be hardwired to the system (you can of course provide easy
way to add all of those, for example if you do not turn "no default
management rules" option on, then all of those rules are added
automatically when you start your IPsec service).
-- 
[email-masked]