Changing to port 4500

Eric Fung writes:
> RFC 4555, Sec. 3.3 says that if both peers support MOBIKE and NAT-T,
> then they must change to port 4500 even if NAT was not detected
> between them.

Yes. 

> But in the design document, RFC 4621, Sec 5.2.3 says that the port change 
> should be done immediately after IKE_SA_INIT and before IKE_AUTH. However, 
> support for MOBIKE is declared during the IKE_AUTH exchange.

RFC4555 does the same. If you check the example in section 2.2 you see
that initiator changes to the port 4500 immediately after IKE_SA_INIT.
It knows at that point that the other end supports NAT-T (the other
end sent NAT_DETECTION_*_IP notifications) and it knows it supports
MOBIKE, so he does the change at that point, even when he is not sure
if the other end supports MOBIKE. 

> I suppose it's not a big deal, since peers will be listening on port 4500 
> anyway. But when should the initiator and responder change ports in the 
> scenario where there is no NAT between them?

RFC 4621 and RFC 4555 agree on that, i.e. IKE_AUTH is already done on
port 4500. 

RFC 4621 is more clear as it says we change to port 4500 immediately
upon detecting that the other end supports NAT-T (this implicitly also
says that we support NAT-T and MOBIKE).

The RFC 4555 has a bit underspecified text saying we change if both
ends supports both, but actually we do not need to  know whether
remote end supports MOBIKE, knowing that it supports NAT-T is
enough. Anyways examples make it very clear that we change to port
4500 for the IKE_AUTH.
-- 
[email protected]