RE: RE: [Ipsec] Asymmetric Security

At 9:35 AM -0500 2/15/05, <[email protected]> wrote:
>Hi Steve,
>
>Response inline.
>
>Atul
>
>
>>  -----Original Message-----
>>  From: [email protected]
>>  [mailto:[email protected]]On
>>  Behalf Of ext Stephen Kent
>>  Sent: Monday, February 14, 2005 11:55 PM
>>  To: Sharma Atul (Nokia-ES/Boston)
>>  Cc: [email protected]; [email protected]; [email protected]
>>  Subject: [Mobike] RE: [Ipsec] Asymmetric Security
>>
>>
>>  At 9:10 AM -0500 2/14/05, <[email protected]> wrote:
>>  >Thanks Yoav, for bringing another scenario needing
>>  Asymmetric support.
>>  >More such scenarios we can bring the better.
>>  >
>>  >The question is whether IKEv2 and 2401bis are sufficient to handle
>>  >the Asymmetric Security needs or do we need something extra? Things
>>  >like:
>>  >	Do we allow different tunnel endpoints in the two direction of
>>  >	a tunnel?
>>
>>  this is not a well-formed question; a tunnel is composed of two SAs.
>>  what do you  mean to ask here?
>
>I will make it more explicit, with one example scenario:
>	So let us say SA pair has the SAs: SA1, SA2. The gateways X and Y.
>	For the sake of simplicity let us just have Y multihomed with addresses
>	Y1 and Y2. So for SA1 tunnel endpoints are X and Y1, for SA2 tunnel
>	endpoints are Y2 and X.
>
>Is something like this allowed now?

I think my other message addressed this question, but frankly the 
text above is very unclear. try explaining it again.

>
>>  >	Do we allow IKE negotiations to be asymmetric?
>>
>>  again, not well-formed. are you referring to anything other than S/D
>>  addresses? how about ports?
>
>In the above example, IKE in forward direction go X->Y1, but comeback
>Y2->X.
>
>Is that allowed? As far as I know, it is not allowed.

so, if I understand your question, it is whether a multi-homed SG can 
accept IKE packets on one interface and send them back via the other 
interface, labelled with the source address of the second interface. 
My guess is that IKE would not react well to this. Note that IKE SAs 
do not share all the features of ESP or AH SAs. In ESP or AH, we 
tolerate the situation in which the source address for an inbound 
packet either is irrelevant to processing (for the outer address in 
tunnel mode) or we can accommodate multiple valid source addresses 
(for transport mode or the inner address in tunnel mode, if 
configured in the SPD).

Steve