Subject: [IPsec] Question regarding usage of "IDr" field in the IKEv2 signalling.

From: "Ameya Damle" <[email-masked]>
Date: Thu, 13 Nov 2008 18:27:09 -0800

Hello everyone,

There's some discussion going on in 3GPP SA2 WG (for TS 23.402) regarding
usage of IDr field in the IKEv2 signalling.
The problem we are discussing there is that when the UE (the initiator of
the IPsec SA) includes an identity of the PDN (APN)  it wants to connect in
the IDr field, then can the responder change the IDr field to include a
different APN  when it sends the IKE_AUTH response message?

I tried to read through the RFC 4306 but somehow this point was not clear to
me.

The text in RFC 4306, section 1.2 (page 8) says that,

 "The optional payload IDr enables the initiator to specify which of the
responder's identities it wants to talk to.  This is useful when the machine
on which the responder is running is hosting multiple identities at the same
IP address.  ………….....

 .......The responder asserts its identity with the IDr payload, optionally
sends one or more certificates …. "

My understanding on reading the text above is that, when the initiator
includes the IDr payload, the responder just asserts or maintains the same
IDr in the response. Hence the IDr field cannot be changed.

Is that the correct understanding ?
Can you please clarify whether or not IDr field can be changed, when UE
includes it during tunnel establishment ?

Thanks,
--
Ameya Damle
 Marvell Semiconductors,
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Scott C Moonen <[email-masked]>
Date: Thu, 13 Nov 2008 22:11:06 -0500

Hi Ameya,

If you read the current draft of IKEv2 maintenance (
http://tools.ietf.org/html/draft-ietf-ipsecme-ikev2bis-01) you'll find the 
following text to answer your question.  While this is not yet an RFC, it 
does represent the general opinion of how RFCs 4306 and 4718 should be 
understood:

   The optional payload IDr enables the initiator to specify which of
   the responder's identities it wants to talk to.  This is useful when
   the machine on which the responder is running is hosting multiple
   identities at the same IP address.  If the IDr proposed by the
   initiator is not acceptable to the responder, the responder might use
   some other IDr to finish the exchange.  If the initiator then does
   not accept that fact that responder used different IDr than the one
   that was requested, the initiator can close the SA after noticing the
   fact.

Scott Moonen ([email-masked])
z/OS Communications Server TCP/IP Development
http://scott.andstuff.org/
http://www.linkedin.com/in/smoonen

From:
"Ameya Damle" <[email-masked]>
To:
[email-masked]
Cc:
Stefano Faccin <[email-masked]>, [email-masked]
Date:
11/13/2008 09:27 PM
Subject:
[IPsec] Question regarding usage of "IDr" field in the IKEv2 signalling.

Hello everyone,
 
There's some discussion going on in 3GPP SA2 WG (for TS 23.402) regarding 
usage of IDr field in the IKEv2 signalling.
The problem we are discussing there is that when the UE (the initiator of 
the IPsec SA) includes an identity of the PDN (APN)  it wants to connect 
in the IDr field, then can the responder change the IDr field to include a 
different APN  when it sends the IKE_AUTH response message? 
 
I tried to read through the RFC 4306 but somehow this point was not clear 
to me. 

 "The optional payload IDr enables the initiator to specify which of the 
responder's identities it wants to talk to.  This is useful when the 
machine on which the responder is running is hosting multiple identities 
at the same IP address.  ………….....

 
 
Thanks,