Subject: [Pana] comments to pana-ipsec

From: Tschofenig Hannes <[email-masked]>
Date: Mon, 13 Oct 2003 17:19:19 +0200

hi mohan, 
hi all, 

working on a pana implementation (including packet filter creation and ipsec
sa establishment) we had to notice that there is a problem getting pana and
ike to interact. 

after pana authentication and key exchange is finished some parameters (such
as keys and ip address info) have to be provided to ike. using the freeswan
(pluto) and freebsd (racoon) ike implementations we noticed that these
parameter cannot be added dynamically. these implemenations require changes
to plaintext files and some other configuration steps which makes the
interworking difficult (without speaking about the performance impact).

is someone aware of an ike implementation which allows ike to be configured
dynamically (possible via an api)?

ciao
hannes

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Tschofenig Hannes <[email-masked]>
Date: Tue, 14 Oct 2003 08:48:50 +0200

hi mohan, 

thanks for pointing to work done at the 3gpp2. unfortunately i am only
familiar with 3gpp work where no such mechanisms are used. could you provide
a pointer to the document?

ciao
hannes

> -----Original Message-----
> From: Mohan Parthasarathy [mailto:[email-masked]]
> Sent: Monday, October 13, 2003 8:56 PM
> To: Tschofenig Hannes; [email-masked]
> Subject: Re: [Pana] comments to pana-ipsec
> 
> 
> 
> > hi mohan,
> > hi all,
> >
> > working on a pana implementation (including packet filter 
> creation and
> ipsec
> > sa establishment) we had to notice that there is a problem 
> getting pana
> and
> > ike to interact.
> >
> > after pana authentication and key exchange is finished some 
> parameters
> (such
> I don't know of an implementation. Others might know. But this is not
> totally new.
> In 3GPP2, IKE implementations had to provide an API where the 
> pre-shared key
> was derived outside of IKE  configuration. If i remember 
> correctly it was
> more like
> an opaque ID_KEY_ID that is given to IKE (derived using FA, 
> HA, etc.) for
> presenting in phase I by FA to HA. Perhaps the standard ones 
> don't have it
> and
> one had to implement it.
> 
> -mohan
> 
> > ciao
> > hannes
> >

---

From: Tschofenig Hannes <[email-masked]>
Date: Tue, 14 Oct 2003 08:48:50 +0200

hi mohan, 

ciao
hannes