: FW: IPSec use with Diameter (from the IPSEC WG list)

mohanlal jangir wrote:

 >> Here is one paragraph from RFC 3588 (Diameter Base Protocol):
 >>
 >> "Note that IPsec is considerably less flexible than TLS when it comes to
 >> configuring root CAs. Since use of Port identifiers is prohibited
 >> within IKE
 >> Phase 1, within IPsec it is not possible to uniquely configure trusted
 >> root
 >> CAs for each application individually; the same policy must be used
 >> for all
 >> applications. This implies, for example, that a root CA trusted for
 >> use with
 >> Diameter must also be trusted to protect SNMP. These restrictions can be
 >> awkward at best.
 >> Since TLS supports application-level granularity in certificate
 >> policy, TLS
 >> SHOULD be used to protect Diameter connections between administrative
 >> domains. IPSec is most appropriate for intra-domain usage when pre-shared
 >> keys are used as a security mechanism."

Scott G. Kelly wrote:

 > It's wrong. Granted, the original IPsec RFC's were not very clear on how
 > you configure something like this, but what is discussed above is an
 > implementation problem probably resulting from a design decision to only
 > permit one IKE SA between a given endpoint pair. It has always been
 > possible to use granular per-port policies, and if a particular
 > implementation does not support this, it's not because of a restriction
 > in the IPsec standard.