Re: [IPsec] RE: TS updates in MOBIKE

Vidya Narayanan wrote:

> This gives the impression that the IP address to which the IKE_SA is
> tied is not important.  That is the address that is going to serve
> as the tunnel endpoint for tunnel mode SAs and hence, has some
> consequence.  I would think that typical implementations reject
> CREATE_CHILD_SA requests for rekeying an SA, sent from a different
> IP address than to which the IKE_SA is currently tied - is that not
> true?  RFC4306 is not clear about this.

We faced this question when designing MOBIKE, and resolved
it as follows (RFC 4555, Section 3.3):

   When an IPsec SA is created, the tunnel header IP addresses (and
   port, if doing UDP encapsulation) are taken from the IKE_SA, not
   the IP header of the IKEv2 message requesting the IPsec SA.  The
   addresses in the IKE_SA are initialized from the IP header of the
   first IKE_AUTH request.

In other words: the CREATE_CHILD_SA request is not rejected, and 
the reply is still sent back to the address the packet came from;
but the tunnel endpoints are initialized from stored information
(which can be updated by UPDATE_SA_ADDRESSES).

Best regards,
Pasi