Subject: Re: [IPsec] Question about port floating in IKEv2

From: Keith Welter <[email-masked]>
Date: Thu, 5 Aug 2010 08:06:54 -0700

Thanks Matt, question below.

> Message: 4
> Date: Thu, 5 Aug 2010 16:46:29 +0200
> From: Matthew Cini Sarreo <[email-masked]>
> Subject: Re: [IPsec] Question about port floating in IKEv2
> To: [email-masked]
> Message-ID:
>    <[email-masked]>
> Content-Type: text/plain; charset="iso-8859-1"
> 
> Only requests are allowed to float ports, 

Where is that stated?

> responses MUST always be sent to
> the address and port they were received from. The NAT_DETECTION_*_IP
> payloads should still be computed using the original ports.
> 
> For example:
> IKE_SA_INIT Request:
> x.x.x.x:501 to n.n.n.n:501. NAT_DETECTION_*_IP uses ports 501.
> 
> IKE_SA_INIT Response:
> During parsing, NAT is detected and the responder keeps track of this 
and
> which side is behind NAT.
> n.n.n.n:501 to x.x.x.x:501. NAT_DETECTION_*_IP uses ports 501.
> 
> IKE_AUTH request:
> NAT has been discovered by both sides at this point and both sides know 
who
> is behind an NAT device.
> x.x.x.x:4500  to n.n.n.n:4500. NON-ESP marker is included.
> 
> Etc...
> 
> Note that port 501 is used to make the point clearer. Reply to the port
> received from, regardless of what it is.
> 
> Hope this helps,
> Matt

---

From: Matthew Cini Sarreo <[email-masked]>
Date: Thu, 5 Aug 2010 17:23:42 +0200

>From section 2.11 (Address and Port agility)
MUST respond to the address and port from which the request was received.

>From section 2.33 (NAT Traversal)
An initiator can use port 4500 for both IKE and ESP,

Also
   o  The IKE initiator MUST check the NAT_DETECTION_SOURCE_IP or
NAT_DETECTION_DESTINATION_IP payloads if present and if they do not match
the addresses in the outer packet MUST tunnel all future IKE and ESP packets
associated with this IKE SA over UDP port 4500.

This implies that only the initiator (of a request) can change the ports as
the responder is forced to keep replying using the same port on which the
request was received.

In the way I understand it, this is not for the original initiator but for
the initiator of the next exchange after the IKE_SA_INIT exchange is done.
So if the original responder would initiate IKE_AUTH, it is allowed to float
to 4500. I might be wrong as the text states the IKE initiator, so it could
be that only the original initiator can do this, but if it is so, this might
be problematic.

Regards,
Matt

On 5 August 2010 17:06, Keith Welter <[email-masked]> wrote:

> > During parsing, NAT is detected and the responder keeps track of this and
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec
>
>

---

From: Keith Welter <[email-masked]>
Date: Thu, 5 Aug 2010 09:11:12 -0700

Thanks again Matt.

I was lead astray by this text:
   Port 4500 is reserved for UDP-encapsulated ESP and IKE.  An IPsec
   endpoint that discovers a NAT between it and its correspondent (as
   described below) MUST send all subsequent traffic from port 4500,
   which NATs should not treat specially (as they might with port 500).

It seems to me that "all subsequent traffic" contradicts the other text 
you referred to.  Assuming that the intent is that only requests are 
allowed to float ports then I think this "all subsequent traffic" text is 
incorrect.

I understand that IKEv2bis is on the RFC editor's queue so it is probably 
too late to modify this text directly.  I wonder if anyone else thinks 
this issue is worth addressing, perhaps as an erratum?

Keith Welter
IBM z/OS Communications Server Developer
1-415-545-2694 (T/L: 473-2694)

Matthew Cini Sarreo <[email-masked]> wrote on 08/05/2010 08:23:42 AM:

> [image removed] 
> 
> Re: [IPsec] Question about port floating in IKEv2
> 
> Matthew Cini Sarreo 
> 
> to:
> 
> Keith Welter, ipsec
> 
> 08/05/2010 08:25 AM
> 
>    NAT_DETECTION_DESTINATION_IP payloads if present and if they do 
> not match the addresses in the outer packet MUST tunnel all future 
> IKE and ESP packets associated with this IKE SA over UDP port 4500.
> 
> This implies that only the initiator (of a request) can change the 
> ports as the responder is forced to keep replying using the same 
> port on which the request was received.
> 
> In the way I understand it, this is not for the original initiator 
> but for the initiator of the next exchange after the IKE_SA_INIT 
> exchange is done. So if the original responder would initiate 
> IKE_AUTH, it is allowed to float to 4500. I might be wrong as the 
> text states the IKE initiator, so it could be that only the original
> initiator can do this, but if it is so, this might be problematic.
> 
> Regards,
> Matt
> 

and
> > NAT has been discovered by both sides at this point and both sides 
know who

---

From: Matthew Cini Sarreo <[email-masked]>
Date: Thu, 5 Aug 2010 22:56:40 +0200

I think all subsequent traffic refers to all new IKEv2 requests and all ESP
traffic originating from the IPsec endpoint where the IKEv2 that discovered
the NAT is on.

Regards,
Matt

On 5 August 2010 18:11, Keith Welter <[email-masked]> wrote:

> It seems to me that "all subsequent traffic" contradicts the other text you
> referred to.  Assuming that the intent is that only requests are allowed to
> float ports then I think this "all subsequent traffic" text is incorrect.
>
> too late to modify this text directly.  I wonder if anyone else thinks this
> issue is worth addressing, perhaps as an erratum?
>
>
> Keith Welter