Subject: RE: Question on IKERejectAction in IPsec information model

From: "Jason, Jamie" <[email-masked]>
Date: Tue, 20 Feb 2001 09:12:56 -0800

Cliff,

let me look into this and see if the DMTF model/whitepaper sheds any light
on it.  Upon re-reading the section, it seems to be vague and at a minimum
should probably discuss the different scenarios when that particular action
may be triggered (i.e., data packet sent/arrived with no SA, IKE packet
arrives, etc.).

Jamie

> -----Original Message-----
> From: Wang, Cliff [mailto:[email-masked]]
> Sent: Monday, February 19, 2001 11:11 AM
> To: [email-masked]
> Subject: Question on IKERejectAction in IPsec information model 
> 
> 
> In the information mode:
> 
> 6.5. The Class IKERejectAction
> 
>    The class IKERejectAction is used to prevent attempting an IKE
>    negotiation with the peer(s).  The class definition for
>    IKERejectAction is as follows:
> 
>    NAME         IKERejectAction
>    DESCRIPTION  Specifies that an IKE negotiation should not even be
>                 attempted.
>    DERIVED FROM SAStaticAction
>    ABSTRACT     FALSE
>    PROPERTIES   DoLogging
> 
> 
> What is the action on the packet, discard/drop/use static SA? It only
> specifies no IKE negotiation.
>

---

From: Eric Vyncke <[email-masked]>
Date: Wed, 21 Feb 2001 01:53:59 +0100

Jamie,

As far as I can remember, this action was mainly to reject an IKE
session from specific peers. I.e. actually denying a remote peer
to send IKE packet to us. The filter could be on IP addresses or
IKE identity (in the case of aggressive mode).

Hence, if I am not mistaken, the description is wrong and should
be fixed.

Cliff, 

this action should only be applied for inbound filters for
UDP/500 or from some IKE identities.

-eric

>> specifies no IKE negotiation.

Eric Vyncke                        
Distinguished Engineer             Cisco Systems EMEA
Phone:  +32-2-778.4677             Fax:    +32-2-778.4300
E-mail: [email-masked]          Mobile: +32-475-312.458 (CHANGED)
PGP fingerprint: D35F BEF9 643F 656F 90F5  76C5 9CA1 C289 D398 B141