Subject: [mif] Securing Multiple Interfaces with IPsec

From: Daniel Migault <[email-masked]>
Date: Tue, 2 Dec 2014 13:42:51 +0100

Hi,

We would like to inform you that the ipsecme WG has started an survey of
interest <http://www.ietf.org/mail-archive/web/ipsec/current/msg09442.html>
[1] for the draft-mglt-ipsecme-clone-ike-sa
<https://datatracker.ietf.org/doc/draft-mglt-ipsecme-clone-ike-sa/> [2].
This draft details how to set IPsec Security Associations with multiple
Interfaces. If you think this topic should or should not be addressed
please respond to this mail by December 8.

If you have any question regarding the document, feel free to let us know.

BR

Daniel and Valery (authors of the draft)

*I. Area that may benefit from this optimization:*

The main scenarios we envisioned IPsec with multiple interfaces were:
    - Offload from RAN to WLAN network
    - Resilience
    - Multiple Path TCP: I believe this is the optimal way to have IPsec
with multiple Path TCP for example.

*II. Scenarios that motivated the document*

Initial motivation for the document was to optimize setting IPsec
associations with devices that have more than one interface. Briefly
speaking, currently, setting an IPsec association with multiple interfaces
requires one authentication per interface. This introduces multiple delays,
especially when authentication requires multiple round trip. With the
optimization, we make it possible to configure it with a single
authentication. Authentication is performed on a single interface, and for
the other interfaces, IPsec authentication and settings is "replicated".

Another scenario that motivated us was load sharing between different
security gateways (each of them has its own IP addresses). In this case
client creates IKE SA with any of these security gateways and then could be
moved to another without re-authentication. Of course this assumes that
security gateways can communicate between each other and exchange IKE &
IPsec SA states.

[1] http://www.ietf.org/mail-archive/web/ipsec/current/msg09442.html
[2] https://datatracker.ietf.org/doc/draft-mglt-ipsecme-clone-ike-sa/

-- 
Daniel Migault
Orange Labs -- Security
+33 6 70 72 69 58