Subject: [IPsec] Issue #27 Motivation for using port 4500 vs. 500

From: Tero Kivinen <[email-masked]>
Date: Tue, 23 Sep 2008 15:20:01 +0300

> >     sent to the port from whence they came.  This is because the ports
> >     may be modified as the packets pass through NATs.  Similarly, IP
> >     addresses of the IKE endpoints are generally not included in the IKE
> >     payloads because the payloads are cryptographically protected and
> >     could not be transparently modified by NATs.
> >
> >     Port 4500 is reserved for UDP-encapsulated ESP and IKE.  When working
> >     through a NAT, it is generally better to pass IKE packets over port
> >     4500 because some older NATs handle IKE traffic on port 500 cleverly
> >     in an attempt to transparently establish IPsec connections between
> >     endpoints that don't handle NAT traversal themselves.  Such NATs may
> >     interfere with the straightforward NAT traversal envisioned by this
> >     document.
> 
> Everything after the first sentence in the paragraph is just
> misleading and should be removed.
> 
> ===Not done. This was generally agreed to, I believe.

The text in sense is true, but it is not really relevant with the
current IKEv2. It was relevant in the case where people still tried to
run the same kind of NAT-T protocols over port 500. In the current
document I think it is just much better to say that you MUST use port
4500 if NAT is detected. This is already said here:

      The IKE initiator MUST check these payloads if present and if they
      do not match the addresses in the outer packet MUST tunnel all
      future IKE and ESP packets associated with this IKE_SA over UDP
      port 4500.

So as current conforming IKEv2 implementations cannot use port 500
when NAT is detected, I think it is bit misleading to explain
something that it is better to do xxx if you are anyways required to
do xxx. 
-- 
[email-masked]
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 23 Sep 2008 16:15:44 -0700

>something that it is better to do xxx if you are anyways required to

OK I see that now. The text you want removed is *above* the text 
below, outside of the optional NAT-traversal requirements. (And, yes, 
I did mean to use "optional" and "requirements" in that sentence.) 
But I can see that the supposedly-helpful text could actually lead to 
a developer using 500 anyway for some bad reason.

--Paul Hoffman, Director
--VPN Consortium

---

From: Tero Kivinen <[email-masked]>
Date: Wed, 24 Sep 2008 14:08:26 +0300

> a developer using 500 anyway for some bad reason.

Yes, I wanted to modify 

   Port 4500 is reserved for UDP-encapsulated ESP and IKE.  When working
   through a NAT, it is generally better to pass IKE packets over port
   4500 because some older NATs handle IKE traffic on port 500 cleverly
   in an attempt to transparently establish IPsec connections between
   endpoints that don't handle NAT traversal themselves.  Such NATs may
   interfere with the straightforward NAT traversal envisioned by this
   document. {{ Clarif-7.6 }} An IPsec endpoint that discovers a NAT
   between it and its correspondent MUST send all subsequent traffic
   from port 4500, which NATs should not treat specially (as they might
   with port 500).

to

   Port 4500 is reserved for UDP-encapsulated ESP and IKE.
   {{ Clarif-7.6 }} An IPsec endpoint that discovers a NAT between it
   and its correspondent MUST send all subsequent traffic from port
   4500, which NATs should not treat specially (as they might with
   port 500).

Sorry, for not being clear enough.
-- 
[email-masked]
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec