RE: New issue 19: Same addresses for both directions?

Atul Sharma writes:
> 
> I think this is interaction of two issues here. I tried
> to raise this scenario a couple of days ago to Hannes:
>
> * Simultaneous change of addresses
> * Different IKE address pair in the two directions (Asymmetry)
> 
> My thoughts on these are:
> 
> * If we have prior knowledge of addresses at the other end,
>   some kind of simultaneous change of addresses can be 
>   supported.

It was already decided a while ago that simultaneous change
of addresses will be supported (see issues #13 and #17).

> * For asymmetry, clearly initial IKE negotiations can not
>   support it. (Does it?) In your scenario, at some point in
>   time A1-B1 (or other symmetric pair) IKE negotiations should 
>   have succeeded. Question is once IKE has succeeded can MOBIKE,
>   allow such an asymmetry? For how long (at next renegotiations 
>   such an asymmetry may not be allowed)?

Hmm... issue 19 is about asymmetry for IPsec traffic (ESP/AH),
not IKEv2/MOBIKE messages (I don't think anyone is proposing 
breaking the rule that IKE responses are sent to the same 
address the request came from).

If the MOBIKE protocol ends up sending all addresses of both
parties in the initial IKE negotiations (IKE_SA_INIT/IKE_AUTH),
and each peer selects the addresses for outbound IPsec SAs
independently, then conceivably asymmetry could happen 
even at that point.

>   Also, the issue is of more general nature than just 
>   restricted to MOBIKE. I have been meaning to raise this 
>   issue of asymmetry for sometime to get a new BoF. But am 
>   not familiar with the BoF procedure.
> 
>   What do folks on this list think: a new BoF could be 
>   requested to handle IKE asymmetry? Clearly issue has 
>   more broader implications.

The BoF procedure is explained in RFC 2418. But I don't 
quite see why a BoF would be better place than MOBIKE WG
to discuss this?

Best regards,
Pasi