Subject: [IPsec] Discover IP network type using Configuration Payload

From: sdjugum <[email-masked]>
Date: Thu, 5 Sep 2013 12:57:33 -0700 (PDT)

Hi,

I have a question regarding usage of both IPv4 and IPv6 address in
CFG_REQUEST payload in IKEv2 message. Could there be any (interoperability)
problems with IRAS in general if both types are present, like no support for
both stacks or addresses not available for one type? Could IRAC use that
mechanism to detect the type of network and select one address/network it
prefers if IRAS returns both in reply?
Also, would IRAS return traffic selectors of both type?

Thanks a lot in advance. 

Br,
   Sasa

--
View this message in context: http://ietf.10.n7.nabble.com/Discover-IP-network-type-using-Configuration-Payload-tp383394.html
Sent from the IETF - Ipsec mailing list archive at Nabble.com.

---

From: Yoav Nir <[email-masked]>
Date: Fri, 6 Sep 2013 18:02:07 +0000

Why not both?

Regular network interfaces in most operating systems are dual-atack: they can have an IPv4 address and several IPv6 addresses. So it makes sense for the client to ask for both, and for the IRAS to offer both, if it runs both IPv4 and IPv6 traffic. If for example IPv6 is missing from the reply, this could mean that the IRAS does not support IPv6, or it could mean that it isn't bothering with assigning IPv6 addresses. Similarly, if the client doesn't ask for an IPv6 address, it could mean that it does not support IPv6, or it could mean that it doesn't need configuration from the IRAS. 

Anyway, IKEv2 clients are required to understand IPv6 selectors. They might not use them if they don't support IPv6 traffic, but the IRAS should send TS payloads according to the specification regardless of whether the IRAC requested an IPv6 address.

Yoav