Subject: IPSec on tunneling mechanisms

From: "Mujinga, M" <[email-masked]>
Date: Wed, 3 Mar 2004 09:58:01 +0200

Hi Folks

I'm new in this IPSec business, but question is. 
Can IPSec secure traffic on IPv6 being tunnelled over the IPv4 networks,
e.g. using 6to4 etc?

I'm considering doing research in that area.

Cheers

---

From: Francis Dupont <[email-masked]>
Date: Wed, 03 Mar 2004 12:14:10 +0100

In your previous mail you wrote:

=> RFC 2401 and its comming revision both allow IPv6 over IPv4 (or
IPv4 over IPv6) in tunnel mode but many implementations for reasons
I don't understand (laziness? unfounded fear?) don't support this...

=> there is nothing to search (in the technical domain :-).

Regards

[email-masked]

---

From: Charles Lynn <[email-masked]>
Date: Wed, 3 Mar 2004 08:59:41 -0500 (EST)

> Can IPSec secure traffic on IPv6 being tunnelled over the IPv4
> networks, e.g. using 6to4 etc?

Yes.  2401[bis] uses examples of IPv4 tunneled in IPv4 and IPv6
tunneled in IPv6 for ease of description, but the other two cases,
IPv4 in IPv6 and IPv6 in IPv4 are also valid.  IPsec can be used
in all four scenarios, and IKEv2 can setup the appropriate SAs.

Charlie

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Wed, 3 Mar 2004 09:48:28 -0800

> in all four scenarios, and IKEv2 can setup the appropriate SAs.
One related question.. Can we use a single pair of SA for IPv4 tunneled in IPv4
and IPv4 tunneled in IPv6 traffic between the two hosts i.e the traffic selector needs
to specify a mix of IPv4 and IPv6 selectors ? RFC 3554 is not very clear about
this though it supports ID_LIST concept. Though IKev2 supports multiple traffic
selectors in a single negotiation, it does not allow the mix. In section 2.9,

   Two TS payloads appear in each of the messages in the exchange that
   creates a CHILD_SA pair. Each TS payload contains one or more Traffic
   Selectors. Each Traffic Selector consists of an address range (IPv4
   or IPv6), a port range, and an IP protocol ID. 

Is that right ?

thanks
mohan

---

From: Francis Dupont <[email-masked]>
Date: Thu, 04 Mar 2004 06:06:47 +0100

One related question.. Can we use a single pair of SA for IPv4
  tunneled in IPv4 and IPv4 tunneled in IPv6 traffic between the two
  hosts i.e the traffic selector needs to specify a mix of IPv4 and IPv6
  selectors ?

=> perhaps you mean IPv4 tunneled in IPv4 and IPv6 tunneled in IPv4?
In your description the multiple version addresses are external
IKE doesn't know to do this kind of things...

   Though IKev2 supports multiple traffic selectors in a single
  negotiation, it does not allow the mix. In section 2.9,
   
=> I don't read the section 2.9 this way.

=> so where is the constraint?

     Is that right ?
   
=> I believe it isn't. But note that an implementation can support only
one TS...

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Thu, 4 Mar 2004 09:41:34 -0800

> => perhaps you mean IPv4 tunneled in IPv4 and IPv6 tunneled in IPv4?

Yes. 

> IKE doesn't know to do this kind of things...
Correct. Assume that the external addresses that IKE runs on are IPv4 and i just want a
mix of  traffic selectors.

> => so where is the constraint?
It says IPv4 or IPv6 above.

> => I believe it isn't. But note that an implementation can support only
Sure. But i don't think the spec is clear on this issue.

-mohan

---

From: Stephen Kent <[email-masked]>
Date: Fri, 5 Mar 2004 10:10:50 -0500

>   hosts i.e the traffic selector needs to specify a mix of IPv4 and IPv6

i think that under IKEv2 and 2401bis, you could define the necessary 
selectors to accommodate both classes of traffic on a single pair of 
SAs, through multiple selector payloads.

Steve

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Fri, 5 Mar 2004 09:24:35 -0800

> SAs, through multiple selector payloads.
I am reading section 2.9 of the latest IKEv2 draft.

   Two TS payloads appear in each of the messages in the exchange that
   creates a CHILD_SA pair. Each TS payload contains one or more Traffic
   Selectors. Each Traffic Selector consists of an address range (IPv4
   or IPv6), a port range, and an IP protocol ID. In support of the
   scenario described in section 1.1.3, an initiator may request that
   the responder assign an IP address and tell the initiator what it is.

The "Two" in the first line points to Tsi and Tsr. And each of them contain
either IPv4 or IPv6 as mentioned above. So, it is not clear to me as where
one can mix IPv4 and IPv6 selectors in a single IPsec SA negotiation. Could
you clarify ?

thanks
mohan

---

From: Tero Kivinen <[email-masked]>
Date: Sat, 6 Mar 2004 18:19:29 +0200

> one can mix IPv4 and IPv6 selectors in a single IPsec SA negotiation. Could

Read the text. It says that there are 2 TS payloads (TSi, and TSr).
Each TS payload contains one or more traffic selectors. Each traffic
selector contains either IPv4 or IPv6 range, but as each TS payload
can contain multiple traffic selectors the TS payloads can have both
IPv4 and IPv6 ranges.

I.e.

	TSi =
	    { Traffic selector
	      proto = any, port = 0 - 65535
	      ipv4 range = 10.0.0.1 - 10.0.0.255 }
	    { Traffic selector
	      proto = any, port = 0 - 65535
	      ipv6 range = 2001::1 - 2001::ffff:ffff:ffff:ffff }
	TSr =
	    { Traffic selector
	      proto = any, port = 0 - 65535
	      ipv4 range = 10.0.0.1 - 10.0.0.255 }
	    { Traffic selector
	      proto = any, port = 0 - 65535
	      ipv6 range = 2001::1 - 2001::ffff:ffff:ffff:ffff }

and the actual packet would be (next payload of prev packet is 44):

                           1                   2                   3
       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      ! Nxt Payload=45!C!  RESERVED   !         Payload Length = 64   !
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      ! # of TSs = 2  !                 RESERVED                      !
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      !   TS Type = 7 !IP Proto ID = 0|       Selector Length = 16    |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |           Start Port = 0      |           End Port = 65535    |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                         Starting Address = 10.0.0.1           |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                         Ending Address = 10.0.0.255           |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      !   TS Type = 8 !IP Proto ID = 0|       Selector Length = 40    |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |           Start Port = 0      |           End Port = 65535    |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                         Starting Address = 2001:0000:         |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                           0000:0000:                          |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                           0000:0000:                          |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                           0000:0001                           |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                         Ending Address = 2001:0000:           |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                           0000:0000:                          |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                           ffff:ffff:                          |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                           ffff:ffff                           |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      ! Nxt Payload=??!C!  RESERVED   !         Payload Length = 64   !
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      ! # of TSs = 2  !                 RESERVED                      !
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      !   TS Type = 7 !IP Proto ID = 0|       Selector Length = 16    |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |           Start Port = 0      |           End Port = 65535    |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                         Starting Address = 10.0.0.1           |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                         Ending Address = 10.0.0.255           |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      !   TS Type = 8 !IP Proto ID = 0|       Selector Length = 40    |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |           Start Port = 0      |           End Port = 65535    |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                         Starting Address = 2001:0000:         |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                           0000:0000:                          |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                           0000:0000:                          |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                           0000:0001                           |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                         Ending Address = 2001:0000:           |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                           0000:0000:                          |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                           ffff:ffff:                          |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                           ffff:ffff                           |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-- 
[email-masked]

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Sun, 7 Mar 2004 10:41:31 -0800

Tero,

Thanks for your detailed clarification. Somehow, i managed to read it wrongly all
the times !

-thanks
mohan