Re: [Ipsec] Number of SPD Policies

[Stephen Kent <kent at bbn.com>]

Title: Re: [Ipsec] Number of SPD Policies

At 12:21 PM -0800 4/1/05, Subha wrote:

> Hi
> List-members,
>  
> If I need
> to apply both ESP and AH SAs between the
> two 
> security
> gateways for a given traffic stream, do I need to
> create two
> policies or one policy ?
>  
> Can someone
> indicate this with repect to the following
> combinations
>  
> 1) IKEv1 +
> 2401

YES, the status quo

> 2) IKEv1 +
> 2401bis

not a good match, because 2401bis mandates support for features available in IKEv2 that are not in IKE v1.

> 3) IKEv2 +
> 2401

this combination should work.

> 4) IKEv2 +
> 2401bis

YES, the intended match up

>  
> From IKEv1
> or IKEv2 perspective, my understanding is that there
> are
> no
> restrictictions posted.
>  
> 2401bis
> seems to indicate that if there is nested tunneling  i.e.
> if
> the security
> tunnel is going to terminate in 2 different remote
> gateways,
> then we
> need to have two SPD policies. (Reference Appendix -E in
> 2401-bis)

What 2401bis says is that to accommodate a nested SA, in general, one will need multiple SPD entries and coordinated entries in the forwarding tables on both the protected and unprotected sides of the IPsec boundary. It does not say this is an issue that arises when the endpoints for the tunnel are distinct. The example in Appendix E is just an example, not a comprehensive discussion of how one configures the SPD and forwarding tables to accommodate nesting in general.

> However if the terminating tunnel endpoint is the
> same remote gateway and
> both ESP
> and AH needs to be applied to a particular traffic stream,
> then
> a single SPD
> Policy should suffice. I did not see any statement in
> 2401-bis
> restricting
> this.

In the example you cited above, applying AH and ESP to traffic, note that the SPD definition in 2401bis specifies application of only one security protocol per SA. So I believe that more than one SPD entry is required to achieve even this simple nested SA example.

Steve

_______________________________________________
Ipsec mailing list
Ipsec at ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec