Re: [Ipsec] Number of SPD Policies

[Stephen Kent <kent at bbn.com>]

Title: Re: [Ipsec] Number of SPD Policies

At 4:35 PM -0800 4/1/05, Subha wrote:

> Hi 
> Steve,
>  
> I have some
> follow-up questions.
>  
> In the
> following questions I have assumed that 3 IPsec Protocols shall be
> applied
> on a given
> traffic stream.
>  
> 1) When
> IKEv2 is used with RFC2401 compliant implementation, can a single
> IKEv2
> CREATE_CHILD_SA negotiate IPcomp, ESP and AH SAs for the
> given traffic
> selector?

yes, but as Tero noted, it would be a mistake, in general, to use IKEv2 with 2401.

> 2) When
> IKEv2 is used with RFC2401-bis compliant implementation, there has
> to
> be theee
> IKEv2 CREATE_CHILD_SA Exchanges.
>  
> (1) Plain
> Traffic selectors for IPcomp SA
> (2) Same
> Source IP, Destination IP and IPComp for Protocol  - Traffic
> Selectors for ESP SA
> (3) Tunnel
> Outer Header Source IP, Tunnel Outer Header Destination IP and
> Protocol=ESP
>  for AH
> SA.

yes, one needs to negotiate all three, if you did all three. Again, there seems to be very little motivation for using BOTH AH and ESP, vs. just using ESP with an appropriate integrity algorithm.

>  3) An
> implementation needs to know through some other
> means,
> whether the
> peer supports RFC2401 or 2401-bis.

I would generally expect an implementation that supports IKEv2 to implement 2401-bis, given certain defaults adopted by IKEv2, e.g., ESN for AH or ESP.

Steve

_______________________________________________
Ipsec mailing list
Ipsec at ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec