Fw: New issue 17: Full connectivity

Intoto Inc.
www.intoto.com
----- Original Message ----- 
From: "Srinivasa Rao Addepalli" <[email protected]>
To: <[email protected]>; "Francis Dupont" <[email protected]>
Cc: <[email protected]>
Sent: Monday, September 06, 2004 12:27 PM
Subject: Re: [Mobike] New issue 17: Full connectivity 


> Umm... I guess it depends on how IPSec is implemented.
> 
> At the originitaing security gateway must know the remote peer IP address and uses
> it as Destination IP address.
> 
> On the receiving end, some implementations would only check if the destination
> IP address of the received packet is its local IP address. If so, it consumes the
> packet and if not, the packet is forwarded. Some implementation might go beyond
> this and might even look for exact match. 
> 
> MOBIKE might need to keep both kinds of implementation in mind or make 
> explicit statement on the behaviour it expects from inbound processing.
> 
> Srini
> 
> Intoto Inc.
> www.intoto.com
> ----- Original Message ----- 
> From: "Francis Dupont" <[email protected]>
> To: <[email protected]>
> Cc: <[email protected]>
> Sent: Monday, September 06, 2004 12:00 PM
> Subject: Re: [Mobike] New issue 17: Full connectivity 
> 
> 
> > In your previous mail you wrote:
> > 
> >    >    Yes, certainly a node is likely to know better its own conditions
> >    >    than the other node. But I don't quite understand the last point: 
> >    >    in 2401bis, inbound IPsec SAs don't seem to have the local (tunnel 
> >    >    header) address at all? (unless they're multicast, but 
> >    >    that's beyond IKEv2)
> >    >    
> >    > => tunnel inbound IPsec SAs have a local (destination) 
> >    > end-point address. What I mean is the only way to fix this 
> >    > address is to send a message to the other end saying what 
> >    > address to use. BTW this is the central point of MOBIKE.
> >    
> >    Err, I'm a bit confused today... I cannot find anything in 2401bis
> >    that would actually use the (outer) address in _inbound_ IPsec SAs 
> >    for anything when processing unicast traffic.
> > 
> > => the destination address of packets sent over an IPsec tunnel SA is
> > a mandatory parameter on the sending side, in this case the other peer.
> > 
> >    And if it's not used,
> > 
> > => it is used, here tunnel is not tunnel effect (:-).
> > 
> >    implementations don't even need to store it,
> > 
> > => it is stored. We can argue about the source address of the encapsulating
> > header, but the destination address is a mandatory parameter.
> > 
> >    and MOBIKE does not need to update it, right?
> > 
> > => as this is something the local peer can't update without a signaling
> > with the other peer, this is something which can only be managed with
> > MOBIKE or a similar mechanism (in fact MOBIKE is the explicit mechanism,
> > the other mechanism, the implicit one, is part of NAT traversal).
> >    
> >    Or am I missing something in 2401bis that actually uses it?
> >    
> > => we only misunderstand ourselved (:-).
> > 
> > Regards
> > 
> > [email protected]
> >    
> > _______________________________________________
> > Mobike mailing list
> > [email protected]
> > https://www.machshav.com/mailman/listinfo.cgi/mobike