Subject: [IPsec] Question about port floating in IKEv2

From: Keith Welter <[email-masked]>
Date: Wed, 4 Aug 2010 10:36:48 -0700

Suppose the initiator sends the IKE_SA_INIT request including 
NAT_DETECTION_*_IP payloads with source port 500 and destination port 500 
and there is a NAT between the initiator and the responder.  The responder 
detects the NAT.  What source and destination port should the responder 
use when sending the IKE_SA_INIT response?  IKEv2bis section 2.23 says:
   For this
   reason, even though IKE packets MUST be sent from and to UDP port 500
   or 4500, they MUST be accepted coming from any port and responses
   MUST be sent to the port from whence they came. 
   ...
   Port 4500 is reserved for UDP-encapsulated ESP and IKE.  An IPsec
   endpoint that discovers a NAT between it and its correspondent (as
   described below) MUST send all subsequent traffic from port 4500,
   which NATs should not treat specially (as they might with port 500).

Since the responder detected the NAT, it MUST send all subsequent traffic 
(starting with the IKE_SA_INIT response) with source port 4500.  Also, 
since the response MUST be sent to the port from whence the request came, 
the IKE_SA_INIT response destination port must be 500. 

Is this interpretation correct? 

Keith Welter
IBM z/OS Communications Server Developer
1-415-545-2694 (T/L: 473-2694)

---

From: Dan McDonald <[email-masked]>
Date: Wed, 4 Aug 2010 13:50:40 -0400

> Is this interpretation correct? 

The IKE_SA_INIT response destination port must match what the request was.
This might mean a port OTHER than 500, though.  Consider the behind-the-NAT
initiator who gets his/her ports rewritten by said NAT?  I'll see something
for <me, 500> from <them, XXX>.  I'll send the reply to <them, XXX>.

Dan

---

From: V Jyothi-B22245 <[email-masked]>
Date: Thu, 5 Aug 2010 10:31:06 +0530

As the destination port is not changed, 
NON-ESP marker should not be added to SA-INIT response.

Thanks
Jyothi
-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of Dan McDonald
Sent: Wednesday, August 04, 2010 11:21 PM
To: Keith Welter
Cc: [email-masked]
Subject: Re: [IPsec] Question about port floating in IKEv2

> Since the responder detected the NAT, it MUST send all subsequent 
> traffic (starting with the IKE_SA_INIT response) with source port 
> 4500.  Also, since the response MUST be sent to the port from whence 
> the request came, the IKE_SA_INIT response destination port must be
500.
> Is this interpretation correct? 

The IKE_SA_INIT response destination port must match what the request
was.
This might mean a port OTHER than 500, though.  Consider the
behind-the-NAT initiator who gets his/her ports rewritten by said NAT?
I'll see something for <me, 500> from <them, XXX>.  I'll send the reply
to <them, XXX>.

Dan
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Matthew Cini Sarreo <[email-masked]>
Date: Thu, 5 Aug 2010 16:46:29 +0200

Only requests are allowed to float ports, responses MUST always be sent to
the address and port they were received from. The NAT_DETECTION_*_IP
payloads should still be computed using the original ports.

For example:
IKE_SA_INIT Request:
x.x.x.x:501 to n.n.n.n:501. NAT_DETECTION_*_IP uses ports 501.

IKE_SA_INIT Response:
During parsing, NAT is detected and the responder keeps track of this and
which side is behind NAT.
n.n.n.n:501 to x.x.x.x:501. NAT_DETECTION_*_IP uses ports 501.

IKE_AUTH request:
NAT has been discovered by both sides at this point and both sides know who
is behind an NAT device.
x.x.x.x:4500  to n.n.n.n:4500. NON-ESP marker is included.

Etc...

Note that port 501 is used to make the point clearer. Reply to the port
received from, regardless of what it is.

Hope this helps,
Matt