Subject: RE: Securing the first hop in PANA using IPsec

From: "Mohan Parthasarathy" <[email-masked]>
Date: Sat, 21 Jun 2003 20:01:00 -0700

Yoshihiro,

A few questions below..

> 
> On Mon, May 26, 2003 at 05:37:12PM +0200, Francis Dupont wrote:
> >  In your previous mail you wrote:
> > 
> >    How is the policy of using IP-in-IP negotiated in IKE?
> > 
> > => no, IP-in-IP is not negociated by IKE. IKE can only negociate SAs
> > and in this case IKE negociates the transport mode SA pair 
> to protect
> > packets going through the IP-in-IP tunnel.
> 
> Yes, that is my understanding.
> 
> > 
> >    If you assume
> >    a pre-configured policy on this, it is very hard to interoperate
> >    because (i) in most cases (or policies) transport mode 
> is used without
> >    IP-in-IP encapsulation and thus policy mis-configuration 
> is likely to
> >    occur,
> > 
> > => the IPsec policy is very simple: protect packets going 
> through the
> > IP-in-IP tunnel, i.e., source and destination = PaC and EP 
> (link-local)
> > addresses, protocol = IP-in-IP (4 or 41).
> 
> This is not simpler than using IPsec tunnel mode, since tunnel mode
> automatically comes with tunneling without introducing new policies,
> while IP-in-IP/transport mode needs a new policy to use IP-in-IP
> encapsulation.  I still think that tunnel mode is sufficient.  Why do

You need an SPD entry for negotiating an IPsec SA in both the cases. 
What do you mean by "new" policies ?

> we need IP-in-IP/transport mode?
> 
> > 
> >    and (ii) it is also difficult to detect the mis-configuration
> >    in pre-configured policies (PaC and EP will see IKE succeeded but
> >    subsequent data traffic will not pass).
> > 
> > => I don't understand all this stuff about pre-configured policies.
> > Do you talk about SPD entries or something else?
> 
> I'm talking about SPD.  I used the term "pre-configured" to be
> equivalent to "non-negotiable".  If the use of IP-in-IP is not
> negotiable in IKE, how can any IPsec entity uniquely determine whether
> additional IP-in-IP encapsulation is applied to a transport mode SA?
> Or are you proposing that IP-in-IP encapsulation must be always
> applied to any transport mode SA?
> 
When you negotiate the transport mode SA you send "4" in the protocol
field of ID payload in IKE. 

-mohan

> > 
> >    In addition, PaC and EP may
> >    use not also IP-in-IP/transport mode (for protecting 
> traffic to/from
> >    the Internet) but also just transport mode for local 
> non-ICMP traffic
> >    between PaC and EP (in this case IP-in-IP is clearly an 
> overhead).
> > 
> > => the "local" traffic between the PaC and the EP doesn't matter as
> > soon as IKE can bypass protection and IP-in-IP packets are not
> > recursively encapsulated. The purpose is to protect traffic to/from
> > the Internet and this can be easily done by routing every not-local
> > thing through the tunnel as it is done in current "mobile" 
> IPsec VPNs.
> 
> What do you mean by mobile IPsec VPNs?
> 
> > 
> >    How is the pre-configured policy constructed for this 
> case?  I still
> >    think using tunnel mode is cleanest for protecting 
> traffic to/from the
> >    Internet in the access network since there is not a 
> policy issue of
> >    this kind.
> >    
> > => There is no such policy issue.
> 
> Please see my comment on SPD above.
> 
> Yoshihiro Ohba
> 
>

---

From: Yoshihiro Ohba <[email-masked]>
Date: Sat, 21 Jun 2003 23:18:32 -0700

> field of ID payload in IKE. 

I understood on this part.  Thanks for the clarification.

Yoshihiro Ohba