Subject: [IPsec] Comments about "IKEv2 Redirect"

From: Yoav Nir <[email-masked]>
Date: Sun, 7 Dec 2008 18:11:32 +0200

Hi.

I've read through the IKEv2 Redirect draft, and I have some comments:

1. Section 5 ("Gateway Initiated Redirect") does not specify what the  
client and gateway should do after the redirect message is sent and  
acknowledged. Obviously the client should setup SAs with the new  
gateway. What is less clear is what happens to the IKE and child SAs  
with the first gateway.
One option is to make the REDIRECT/REDIRECT_ACK pair imply a delete of  
the IKE SAs. In that case all further IPsec traffic will be rejected.  
In that case the text should say this clearly.
Another option is that the SAs remain valid until either side  
explicitly closes them. In that case the text should say this, and  
also recommend which side should close the old SAs and how soon (for  
example: the client should delete as soon as it starts setting up the  
new IKE SAs, the gateway should delete after allowing enough time to  
set up new SAs  - one minute?)

2. Section 9: s/with who, /with whom /
I feel really pedantic for this one...

3. Abstract. "IKEv2 is a popular protocol..." this is not strictly  
true. I would lost the "popular". Also, since the abstract gives the  
reasons why we might want to redirect, I think it should include, in  
addition to the overloaded gateway and mobile IPv6 case, the case of  
draining a remote access gateway for maintenance.

4. Introduction. "widely" - same as "popular" in the abstract.

Yoav

_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Mon, 8 Dec 2008 19:57:42 +0200

> set up new SAs  - one minute?)

I think this option would be better. That would be much more in line
with how IKEv2 do things (i.e. for example IKE SA rekeys). 
-- 
[email-masked]
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: "Vijay Devarapalli" <[email-masked]>
Date: Tue, 9 Dec 2008 17:29:39 -0800

Hi Yoav,

On Sun, Dec 7, 2008 at 8:11 AM, Yoav Nir <[email-masked]> wrote:
> 1. Section 5 ("Gateway Initiated Redirect") does not specify what the client
> and gateway should do after the redirect message is sent and acknowledged.
> Obviously the client should setup SAs with the new gateway. What is less
> clear is what happens to the IKE and child SAs with the first gateway.
> One option is to make the REDIRECT/REDIRECT_ACK pair imply a delete of the
> IKE SAs. In that case all further IPsec traffic will be rejected. In that
> case the text should say this clearly.
> Another option is that the SAs remain valid until either side explicitly
> closes them. In that case the text should say this, and also recommend which
> side should close the old SAs and how soon (for example: the client should
> delete as soon as it starts setting up the new IKE SAs, the gateway should
> delete after allowing enough time to set up new SAs  - one minute?)

I added the following text to section 5

   Once the client responds to the gateway with the REDIRECT_ACK
   payload, it SHOULD delete the existing security associations with the
   old gateway.  The gateway MAY also decide to delete the security
   associations without any signaling from the client.  However, it
   should allow sufficient time for the client to setup the required
   security associations with the new security gateway.  This time
   period should be configurable on the gateway.

> 3. Abstract. "IKEv2 is a popular protocol..." this is not strictly true. I
> would lost the "popular". Also, since the abstract gives the reasons why we
> might want to redirect, I think it should include, in addition to the
> overloaded gateway and mobile IPv6 case, the case of draining a remote
> access gateway for maintenance.
>

Removed the words "popular" and "widely". :)

Vijay

---

From: Yoav Nir <[email-masked]>
Date: Wed, 10 Dec 2008 08:47:45 +0200

Hi Vijay

On Dec 10, 2008, at 3:29 AM, Vijay Devarapalli wrote:

>> explicitly

That still doesn't tell me if the deletion is implicit (if the gateway  
redirected, then obviously it doesn't want the SAs any more) or  
explicit (the gateway or the client MUST send deletes, and until then  
the SAs are valid)

>> true. I

Email secured by Check Point
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: "Vijay Devarapalli" <[email-masked]>
Date: Wed, 10 Dec 2008 07:54:19 -0800

Hi Yoav,

On Tue, Dec 9, 2008 at 10:47 PM, Yoav Nir <[email-masked]> wrote:

>>> client
>>> the
> redirected, then obviously it doesn't want the SAs any more) or explicit
> (the gateway or the client MUST send deletes, and until then the SAs are
> valid)

The text above says the client "SHOULD" delete the SAs with the old
gateway. I don't think we should use "MUST" here. If the client does
not delete the SAs, the gateway can still delete the SAs if it wants.
Or just let them expire. I am not sure what more we should specify
here.

Vijay

---

From: Yoav Nir <[email-masked]>
Date: Wed, 10 Dec 2008 22:19:00 +0200

On Dec 10, 2008, at 5:54 PM, Vijay Devarapalli wrote:

>>>> closes them. In that case the text should say this, and also  
>>>> recommend
>>>> which
>> explicit

OK. That answers my question. What I meant (and I still think it  
should be said explicitly) is that the REDIRECT-REDIRECT_ACK pair does  
not implicitly delete the SAs. The client or the gateway still need to  
explicitly send DELETE payloads in a separate Informational exchange.  
Someone suggested off-list that this should be otherwise, and that SAs  
should be immediately deleted (with no further packets) after the  
REDIRECT_ACK is sent and received.

---

From: "Vijay Devarapalli" <[email-masked]>
Date: Wed, 10 Dec 2008 14:06:51 -0800

On Wed, Dec 10, 2008 at 12:19 PM, Yoav Nir <[email-masked]> wrote:
> OK. That answers my question. What I meant (and I still think it should be
> said explicitly) is that the REDIRECT-REDIRECT_ACK pair does not implicitly
> delete the SAs. The client or the gateway still need to explicitly send
> DELETE payloads in a separate Informational exchange. Someone suggested
> off-list that this should be otherwise, and that SAs should be immediately
> deleted (with no further packets) after the REDIRECT_ACK is sent and
> received.

Well, what is proposed above is a mix of both. The client SHOULD
delete the SAs. It if doesn't, the gateway goes ahead and deletes the
SAs anyway. I am not sure the spec needs to say if the gateway should
delete the SAs immediately after the REDIRECT_ACK message is received.

Vijay

---

From: "fan zhao" <[email-masked]>
Date: Wed, 10 Dec 2008 15:06:56 -0800

Hi,

I also agree on this option.

Sincerely,
fan

---

From: "fan zhao" <[email-masked]>
Date: Wed, 10 Dec 2008 15:08:14 -0800

I agree that to explicitly delete the SA, the delete payload should be
sent in a separate message from the one with the redirect payload.

Sincerely,
fan