Subject: [Pana] comments to pana-ipsec

From: Tschofenig Hannes <[email-masked]>
Date: Mon, 13 Oct 2003 17:19:19 +0200

hi mohan, 
hi all, 

working on a pana implementation (including packet filter creation and ipsec
sa establishment) we had to notice that there is a problem getting pana and
ike to interact. 

after pana authentication and key exchange is finished some parameters (such
as keys and ip address info) have to be provided to ike. using the freeswan
(pluto) and freebsd (racoon) ike implementations we noticed that these
parameter cannot be added dynamically. these implemenations require changes
to plaintext files and some other configuration steps which makes the
interworking difficult (without speaking about the performance impact).

is someone aware of an ike implementation which allows ike to be configured
dynamically (possible via an api)?

ciao
hannes

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Mon, 13 Oct 2003 11:55:43 -0700

> dynamically (possible via an api)?
I don't know of an implementation. Others might know. But this is not
totally new.
In 3GPP2, IKE implementations had to provide an API where the pre-shared key
was derived outside of IKE  configuration. If i remember correctly it was
more like
an opaque ID_KEY_ID that is given to IKE (derived using FA, HA, etc.) for
presenting in phase I by FA to HA. Perhaps the standard ones don't have it
and
one had to implement it.

-mohan

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Mon, 13 Oct 2003 11:55:43 -0700

-mohan