Subject: ipsec SAs

From: "George Hadjichristofi" <[email-masked]>
Date: Fri, 18 Jul 2003 12:07:26 -0400

Hi,

I have a question about IPSec SAs.

There is a nework such as:
A----Gateway1 ===tunnel====Gateway2 ----B

A and B are the subnets.
Gateway 1 and 2 negotiate a tunnel such that A can communicate securely with
B.

Based on RFC2401, does that mean that A will only be able to talk to B and
no other nodes on the network, or just that it will talk to B via a secure
tunnel and to everybody else in cleartext?

Should A be able to talk to Gateway2?

Thank you
George

***********************************************************
George C. Hadjichristofi
Graduate Student
Bradley Department of Electrical and Computer Engineering
Virginia Tech,Blacksburg,VA 24061,U.S.A
TEL:(540)-951-8936
***********************************************************

---

From: Henry Spencer <[email-masked]>
Date: Fri, 18 Jul 2003 12:42:51 -0400 (EDT)

> tunnel and to everybody else in cleartext?

Depends on software and configuration.  Either choice might be desirable,
depending on the circumstances.

> Should A be able to talk to Gateway2?

If Gateway2 is a member of subnet B, it should be possible (although the
implementation of this can be tricky).  Otherwise, there's nothing in
having a tunnel to B that would permit it.

                                                          Henry Spencer
                                                       [email-masked]

---

From: Stephen Kent <[email-masked]>
Date: Fri, 18 Jul 2003 18:01:34 -0400

>Should A be able to talk to Gateway2?

The scenario in your diagram is common. The administrators for the 
security gateways decide whether the tunnel that is created between 
them will carry all traffic between any two hosts on the subnets 
behind them, or just traffic between A & B, or even whether a 
separate tunnel is created for each different connection between A & 
B, etc.  Depending on how these administrators choose to define the 
SPD entries for communication between these two subnets, there are 
lots of possibilities.

You ask whether A should be able to talk to  Gateway 2. Again, this 
will be a function of the SPD entries.

Steve

---

From: Ravi <[email-masked]>
Date: Mon, 21 Jul 2003 09:26:56 +0530

Hi,
       It depends on SPD policy you configure.
       If your policy selectors include only 'B' address, then using 
this policy,only B can be reached from A.
       If  your policy selector include complete subnet in which 'B' 
belongs,then all machines in that subnet can be reached from A.

     Ravi

-- 

The views presented in this mail are completely mine. The company is not
responsible for whatsoever.
------------------------------------------------------------------------
Ravi Kumar CH
Rendezvous On Chip (i) Pvt Ltd
Hyderabad, India
Ph: +91-40-2335 1214 / 1175 / 1184

ROC home page <http://www.roc.co.in>