RE: RE: [Ipsec] Asymmetric Security

Hi Steve,

Response inline.

Atul


> -----Original Message-----
> From: [email protected] 
> [mailto:[email protected]]On
> Behalf Of ext Stephen Kent
> Sent: Monday, February 14, 2005 11:55 PM
> To: Sharma Atul (Nokia-ES/Boston)
> Cc: [email protected]; [email protected]; [email protected]
> Subject: [Mobike] RE: [Ipsec] Asymmetric Security
> 
> 
> At 9:10 AM -0500 2/14/05, <[email protected]> wrote:
> >Thanks Yoav, for bringing another scenario needing 
> Asymmetric support.
> >More such scenarios we can bring the better.
> >
> >The question is whether IKEv2 and 2401bis are sufficient to handle
> >the Asymmetric Security needs or do we need something extra? Things
> >like:
> >	Do we allow different tunnel endpoints in the two direction of
> >	a tunnel?
> 
> this is not a well-formed question; a tunnel is composed of two SAs. 
> what do you  mean to ask here?

I will make it more explicit, with one example scenario:
	So let us say SA pair has the SAs: SA1, SA2. The gateways X and Y.
	For the sake of simplicity let us just have Y multihomed with addresses
	Y1 and Y2. So for SA1 tunnel endpoints are X and Y1, for SA2 tunnel
	endpoints are Y2 and X.

Is something like this allowed now?

> >	Do we allow IKE negotiations to be asymmetric?
> 
> again, not well-formed. are you referring to anything other than S/D 
> addresses? how about ports?

In the above example, IKE in forward direction go X->Y1, but comeback 
Y2->X. 

Is that allowed? As far as I know, it is not allowed.