Subject: [IPsec] Revised IKEv2 Re-direct draft

From: "Vijay Devarapalli" <[email-masked]>
Date: Mon, 3 Nov 2008 17:22:56 -0700

Hi,

We just submitted a new draft version for the IKEv2 re-direct
mechanism. Changes made in this version

- Added a section on gateway-initiated re-direct. The earlier versions
only spoke about re-direct during the IKE_SA_INIT exchange
- Updated the reference to IKEv2bis draft
- A few other minor fixes.

Vijay

2008/11/3  <[email-masked]>:
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the IP Security Maintenance and Extensions Working Group of the IETF.
>
>
>        Title           : Re-direct Mechanism for IKEv2
>        Author(s)       : V. Devarapalli, K. Weniger
>        Filename        : draft-ietf-ipsecme-ikev2-redirect-01.txt
>        Pages           : 12
>        Date            : 2008-11-03
>
> IKEv2 is a popular protocol for setting up VPN tunnels from a remote
> location to a gateway so that the VPN client can access services in
> the network behind the gateway.  Currently there is no standard
> mechanism specified that allows an overloaded VPN gateway to re-
> direct the VPN client to attach to another gateway.  This document
> proposes a re-direct mechanism for IKEv2.  The proposed mechanism can
> also be used for Mobile IPv6 to enable the home agent to re-direct
> the mobile node to another home agent.
>
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-ietf-ipsecme-ikev2-redirect-01.txt
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>
> Below is the data which will enable a MIME compliant mail reader
> implementation to automatically retrieve the ASCII version of the
> Internet-Draft.
>
>
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec
>
>
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: "fan zhao" <[email-masked]>
Date: Tue, 4 Nov 2008 14:09:06 -0800

Hi, Vijay and Killian,

I have some comments on draft-ietf-ipsecme-ikev2-redirect-01.

1) The draft describes the redirection during the IKE_SA_INIT exchange
and during the informational exchange that is after the SA is established.
Please correct me if I am wrong. I think the redirection can be done during
the IKE_AUTH exchange, right? We have discussed this before.

2) Near the end of section 3:

   "When this mechanism is used with Mobile IPv6, a mobile node's
   security associations with its home agent may expire while it still
   has a valid binding cache entry at the home agent."
Based on RFC 4877, the lifetime of a dynamically assigned HoA is
the same as that of the SA. So if the SA expires, the HoA expires
and the BCE is invalid too, right?

   "In this case, the
   mobile node MUST NOT use the original home agent address as the
   destination address in the IKE_SA_INIT exchange to setup new security
   associations.  It MUST try to setup security associations with its
   existing home agent."

If I understand correctly, in this case, the MN will use the anycast address
in the IKE_SA_INIT, and then is redirected to the original home agent.
Is this correct?

3) Some editorial issues:

Abstract: The proposed mechanism can
   also be used for Mobile IPv6 to enable the home agent to re-direct
   the mobile node to another home agent.

Maybe it is better:
"The proposed mechanism can also be used in Mobile IPv6 ..."

3.  IKEv2 Exchange with Redirect
   To redirect a IKEv2 session to

s/a/an

Thanks.

Sincerely,
fan

---

From: "Vijay Devarapalli" <[email-masked]>
Date: Wed, 5 Nov 2008 15:23:07 -0700

Hi Fan,

> the IKE_AUTH exchange, right? We have discussed this before.

Yes, but this change has not been made yet. I had presented this issue
at the last IETF, but there were no comments. I was looking for a
little bit more discussion on this before adding this to the document.

> and the BCE is invalid too, right?

The home address and the binding cache entry are not marked invalid
right away. If the SAs expire, the mobile node can run IKEv2 with the
home agent again and request for the same home address.

> in the IKE_SA_INIT, and then is redirected to the original home agent.

No, we wanted to say that the mobile node should try running IKEv2
again with the existing home agent. Not use the anycast address as the
destination address for the IKE_SA_INIT exchange.

>   To redirect a IKEv2 session to

Thanks for catching these.

Vijay

---

From: "fan zhao" <[email-masked]>
Date: Wed, 5 Nov 2008 14:33:18 -0800

Hi Vijay,

Thanks for your reply. Please see below.

> little bit more discussion on this before adding this to the document.
OK.

> home agent again and request for the same home address.
OK. This can be done.

> destination address for the IKE_SA_INIT exchange.

I agree with what you said. Somehow, I read the text differently.

Thanks.

Sincerely,
fan