Subject: Question on inbound IPSEC policy check

From: Jyothi <[email-masked]>
Date: Wed, 23 Apr 2003 13:03:16 +0530

Hi all,

I have a question regarding the inbound SPD policy checking.

Please consider the following scenario:

Office1Network-----SG1---------Internet------------SG2-------Office2Network.

Office1Network has HTTP as well as other services hosted.
Office1 administartor wants to make sure that all HTTP traffic has to go with
3DES and SHA1

And all other traffic can go with AH MD5 and no encyrption is required for
performance reasons.

In this case, if office2Network SG is mis-configured or they did not even
configure HTTP policy.

Then SG1 accepts the HTTP traffic and process it.
After IPSEC processing, SHOULD WE ACCEPT THOSE PACKETS OR DROP THOSE 
PACKETS, because higher priority SPD policy is created for the HTTP traffic.

Any advice on this would be greatly appreciated

Thanks in advance,
Jyothi

---

From: suren <[email-masked]>
Date: Wed, 23 Apr 2003 11:32:03 -0700

Hi Jyothi,
     The HTTP packets, that are coming via  AH-MD5 tunnel
     should be dropped by SG1. You might have been confused by
     text in RFC2401 section 5.2.1 Bullet 3, which reads like this.

     "Find an incoming policy in the SPD that matches the packet.
      This could be done, for example, by use of backpointers
      from the SAs to the SPD or by matching the packet's selectors
      (Inner Header if tunneled) against those of the policy entries
       in the SPD "

     In my view, text indicating "backpointers from SA" is confusing.
     Dropping HTTP traffic in following example by SG1 is good and I would
     like to hear from other IPSEC vendors as it impacts inter-operability.

     I feel the text for bullet 3, should be read like this:
     "Find an incoming policy in the SPD that matches the packet selectors. 
This could be
      done by matching packet selectors against those of the policy entries 
in the SPD
      in their order of priority."

Suren
Intoto Inc
3160, De La Cruz Blvd #100
Santa Clara, CA
www.intotoinc.com

---

From: Ravi <[email-masked]>
Date: Thu, 24 Apr 2003 10:03:40 +0530

Jyothi,
    Since, the SPD policies are ordered list and priority of the SPD
    policies should be followed to check the validity of the decrypted packets w.r.t 
    security policy.
    SG1 will drop the unencrypted packets coming from SG2
    Regards,
     Ravi

-- 

The views presented in this mail are completely mine. The company is not 
responsible for whatsoever.
------------------------------------------------------------------------
Ravi Kumar CH
Rendezvous On Chip (i) Pvt Ltd
Hyderabad, India
Ph: +91-40-2335 1214 / 1175 / 1184

ROC home page <http://www.roc.co.in>

---

From: Stephen Kent <[email-masked]>
Date: Fri, 25 Apr 2003 14:13:59 -0400

>Any advice on this would be greatly appreciated

Yes, the exit check at  SG1 should reject traffic that has either 
source or dest port = 80, consistent with the policy you articulated 
above.

---

From: Jyothi <[email-masked]>
Date: Mon, 28 Apr 2003 11:22:16 +0530

Hi,

If we reject the traffic, how do we inform the peer???
I think there might be some inter-operability issues.

Thanks
Jyothi

>>  office2Network administrator is configured only one policy for all 
>> traffic with AH MD5

>Yes, the exit check at  SG1 should reject traffic that has either source 
>or dest port = 80, consistent with the policy you articulated above.

---

From: Stephen Kent <[email-masked]>
Date: Mon, 28 Apr 2003 09:36:11 -0400

>I think there might be some inter-operability issues.

If the SAs are established using IKE, then the payloads passed during 
the IKE negotiations will inform the peer of the range of allowable 
traffic, so it will not be a surprise.

Steve

---

From: Jyothi <[email-masked]>
Date: Tue, 29 Apr 2003 09:58:24 +0530

Hi,

SG1 contains the 2 IPSEC policies:
     1. protocol TCP and port 80
     2. protocol ANY

SG2 contains the one IPSEC policy of protocol ANY.

Office2Network starts the IKE negotiation for protocol ANY, after the 
negotiation SG2 will send the HTTP traffic with SAs created.

In IKE negotiation, we are informing the allowable traffic as protocol ANY.
  In this case, HTTP is part of protocol ANY.

So, if SG1 rejects inbound traffic coming from SG2,  then how SG2 knows??

Thanks
Jyothi

At 09:36 AM 4/28/03 -0400, Stephen Kent wrote:
>If the SAs are established using IKE, then the payloads passed during the 
>IKE negotiations will inform the peer of the range of allowable traffic, 
>so it will not be a surprise.
>
>Steve

---

From: Ramana Yarlagadda <[email-masked]>
Date: Tue, 29 Apr 2003 10:21:06 -0700

Hi, Jyothi

>So, if SG1 rejects inbound traffic coming from SG2,  then how SG2 knows??

Why do you think the inbound traffic will be dropped? To my understanding 
the traffic will not be discarded.
On SG1 the incoming SA (that is been setup by IKE) will be used to process 
the packet. And then it will try
to find a matching IPSEC policy . The first matching entry will be protocol 
specific , where the SA is not of
that policy. So you might be thinking that this will result to drop the 
packet. But if you go through section 5.2.1
you will see a NOTE where it is clearly described this case( and as follows)

NOTE: The correct "matching" policy will not necessarily
               be the first inbound policy found.  If the check in (4)
               fails, steps (3) and (4) are repeated until all policy
               entries have been checked or until the check succeeds

-ramana

---

From: Stephen Kent <[email-masked]>
Date: Wed, 30 Apr 2003 17:14:18 -0400

At 9:58 AM +0530 4/29/03, Jyothi wrote:
>Office2Network starts the IKE negotiation for protocol ANY, after 
>the negotiation SG2 will send the HTTP traffic with SAs created.
>

I don't understand all of the assumptions underlying your example. 
Note that SPD entries are directional, and thus must be separately 
defined for inbound and outbound traffic flows. So, please restate 
your example in those terms, and let's see if there is a problem. 
Ramana's message indicated why this might not be a problem, but until 
you state the full set of assumptions about the SPDs at each end, I 
don't know how to interpret the example.

Steve