Subject: [IPsec] IKE_INIT spoofing from SaudiNet and Zain Data-Jordan ?

From: Paul Wouters <[email-masked]>
Date: Mon, 3 Dec 2018 11:55:36 -0500 (EST)

Hi,

I've seen reports where our software receives IKE_AUTH requests without
the preceeding IKE_INIT request. After some debugging, it seems that
two networks, SaudiNet and Zain Data-Jordan, sometimes MITM the IKE_INIT
by replying (and I guess generating a IKE SPI for the responder) and
then step away to let the IKE_AUTH fail, since the responder never
received the original IKE_INIT.

Has anyone else seen this as well? Is this some surveilance tool that
is being buggy, or is this behaviour the intended result? It seems to
be happening intermittently.

Paul, almost curious enough to hack in an IKE_INIT request in an IKE_AUTH
marked exchange packet :P