Re: Issue 73: Port numbers in examples

Stephane Beaulieu (stephane) writes:
> Hi Pasi,
> 
> Thanks.  I meant to follow up with an email, but it slipped my mind.
> 
> There's also another piece of text in section 3.5 which is misleading.
> 
> <snip>
> o  If the IPsec SAs were updated in the previous step: If NAT
>       Traversal is not enabled, and the responder supports NAT Traversal
>       (as indicated by NAT detection payloads in the IKE_SA_INIT
>       exchange), and the initiator either suspects or knows that a NAT
>       is likely to be present, enables NAT Traversal (that is, enables
>       UDP encapsulation of outgoing ESP packets and sending of NAT-
>       Keepalive packets).
> <end snip>
> 
> This implies that we didn't already switch to port 4500 as was mentioned
> earlier in the doc.  My impression is that we were always doing UDP
> encaps on port 4500.  (or are we just switching IKE to port 4500, but
> not doing UDP encaps?)

Yes. We simply move all IKE traffic to port 4500 immediately when we
notice that other end supports NAT regardless whether there is NAT or
not. The IPsec SAs are still created using normal ESP packets in case
there is no NAT, and if we move behind NAT then we change those IPsec
SAs to use UDP encapsulation too. If we move away from NAT then we
again disable the UDP encapsulation of IPsec packets, but keep the IKE
traffic on port 4500.

The reason for this is that if we would do the port switch when we
later detect NAT, it would cause the additional complexity, as
responder do not know the addresses that are going to be used in the
encapsulated packets, as initiator wouldn't had sent any packets with
those addresses and NAT wouldn't have created mapping for the packets
yet. 
-- 
[email protected]