Subject: Traffic selectors in IKEv2

From: "Mohan Parthasarathy" <[email-masked]>
Date: Fri, 20 Feb 2004 10:33:35 -0800

I have a couple of questions on the Traffic selectors in IKEv2.

1) Traffic selectors allow a range of addresses. Is the range encompassing all the addresses
    from 0 to 255.255.255.255 valid (similarly for IPv6) ? Nothing in the spec seems to
    preclude it.

2) IKEv2 specifically allows multiple IPsec SAs to co-exist (and be used) for the same traffic
    selector between same endpoints. i would assume that multiple SAs for the selectors specifying
   all the addresses is still possible between the same endpoints. Is that allowed ?

thanks
mohan

---

From: "Charlie Kaufman" <[email-masked]>
Date: Fri, 20 Feb 2004 16:15:06 -0800

My reading of the spec is that this is allowed, and I can imagine it
being useful. If I as a road warrior tunnel into my corporate network
and want all of my internet traffic to be routed through the corporate
network in order to protected by its firewall, I would want to tunnel
all addresses.

Stretching my imagination only a little further, I can imagine wanting
multiple SAs to separate voice and data traffic (because the network
might do some different QOS for the two kinds of traffic).

	--Charlie

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Mohan Parthasarathy
Sent: Friday, February 20, 2004 10:34 AM
To: [email-masked]
Subject: Traffic selectors in IKEv2

1) Traffic selectors allow a range of addresses. Is the range
encompassing all the addresses
    from 0 to 255.255.255.255 valid (similarly for IPv6) ? Nothing in
the spec seems to
    preclude it.

2) IKEv2 specifically allows multiple IPsec SAs to co-exist (and be
used) for the same traffic
    selector between same endpoints. i would assume that multiple SAs
for the selectors specifying
   all the addresses is still possible between the same endpoints. Is
that allowed ?

thanks
mohan

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Fri, 20 Feb 2004 17:24:49 -0800

Charlie,
 
> network in order to protected by its firewall, I would want to tunnel
In this case, the road warrior would use TSr with the selector that encompasses
all addresses ("all-traffic") and TSi as its own address allocated earlier in the
CFG request.

I wanted to know about the TSi. Can TSi contain the "all-traffic" selector ?
This is useful for other VPN cases e.g. PPVPNs. In this case, you need
other mechanisms to direct traffic to the right tunnel. In the road warrior case
SG would use the road warrior's address to direct packets to the tunnel.
So, can TSi and TSr contain "all-traffic" selector ? I assume that the
spec itself does not preclude this. But the peer may refuse to accept (or trim) such
a selector. Is that right ?

-thanks
mohan