Subject: Re: 2401bis Issue #67 -- IPsec management traffic

From: Karen Seo <[email-masked]>
Date: Fri, 3 Oct 2003 01:19:15 -0400

Hi Francis,

>  In your previous mail you wrote:
>
>    There is one slight catch, however. There is no SPD entry action to
>    cause delivery of a received message to IKE. So, while your example
>    is appropriate for outbound IKE traffic, I don't think we ever
>    defined a way to express appropriate internal forwarding of inbound
>    IKE traffic.  Any suggestions?
>   
>=> I agree but I don't believe there is a solution inside IPsec itself:
>to enforce the delivery of packets maching a filter to a process/user/...
>is a "personal firewall" function only.

	[Throwing in a few pennies until Steve returns...]

	Are you speaking of hosts here?  While it might work there,
	a "personal firewall" seems odd applied to SGs.  A general
	solution would be to add another action in the SPD, e.g.,
	"direct to security management".

Karen

---

From: Markku Savela <[email-masked]>
Date: Fri, 3 Oct 2003 09:46:46 +0300

> >    IKE traffic.  Any suggestions?

This discussion seems totally absurd to me. You just install "pass
through in clear" policy entries for that traffic. Just simple policy
selector with port 500, for example? That's the way it works for me.

All traffic to and from a host should pass through IPSEC policy
check. If some implementations goof up on this, it's their bug. No
need to mess with IPSEC RFC.

---

From: Francis Dupont <[email-masked]>
Date: Sat, 04 Oct 2003 16:08:38 +0200

Are you speaking of hosts here?

=> the "internal forwarding" is a host function, i.e., this applies
to SGs considered as hosts.

        While it might work there, a "personal firewall" seems odd
        applied to SGs.

=> "personal firewalls" are the only common security tools which can
bind a traffic to an application.

        A general
   
=> this makes no sense because you can't really define what is the
"security management". IMHO the issue is clearly outside the IPsec scope,
i.e., we can make security recommendations but we can't specify a
solution.

Regards

[email-masked]

PS: as an implementor: the easy solution is to put a part of IKE inside
the kernel, as it should be already done for the UDP port 4500.

---

From: Francis Dupont <[email-masked]>
Date: Sat, 04 Oct 2003 16:27:52 +0200

=> IMHO we don't understand the same thing. My interpretation of the issue
is how to enforce that UDP port 500 is delivered to the IKE daemon. My
opinion is that this is an interesting question but this is out of the
scope of IPsec SPD.

Regards