RE: [Ipsec] Asymmetric Security

Atul,

>
>  > >
>>  >(1) Asymmetry in Gateways:
>>  >Let us say there are three gateways A, B, C. In the forward
>>  >direction secure traffic
>>  >flows from Gateway A to Gateway B. In the reverse direction
>>  traffic flows from
>>  >Gateway C to Gateway A.  A Mobile IP End-to-End Security between a
>>  >correspondent node and a mobile node will be an example
>>  scenario here.
>>  >IKE negotiations between A and B can setup a tunnel and IKE
>>  negotiations
>>  >between C and A can set up the tunnels. Both the tunnels shall still
>>  >protect the
>>  >same hosts/addresses. [Since IKE negotiations do not allow
>>  asymmetry we will
>>  >have to have two separate IKE negotiations]
>>
>>  so, what's the problem? you have separate SAs because you have
>>  different endpoints. we decided long ago to create SAs in pairs. are
>>  you concerned that the state maintained for the unused SAs is a
>>  unacceptable burden?
>
>Only that there is no unused SAs or rather no unused SA pairs. There will
>be two SA pairs negotiated each with different tunnel endpoints. In the
>first SA pair only the forward SA will be used, in the second SA pair only
>the reverse SA will be used. Is something like this already allowed?

It is allowed, and the only possible problem I might see is if DPD 
mechanisms were confused by the lack of traffic one one of the SAs in 
each peer.

>One SA in each pair shall be unused, which need not even be maintained.

true in principle, but unless an implementation suffers from 
maintaining this extraneous state, it's not a big deal.

>A related question: Do we allow IKE negotiations to be asymmetric, i.e. IKE
>message goes to an address, but the response comes back from a different
>address?

That's an IKE question, ask Charlie.

>
>>  >(2) Asymmetry in Tunnels:
>>  >Let us say there are two multihomed Gateways. These gateways
>>  negotiate TWO
>>  >tunnels, each with different tunnel endpoints (corresponding to
>>  >multihomed addresses).
>>  >But both the tunnels still protecting the same hosts/addresses. This
>>  >can be a real
>>  >life scenario to acheive redundancy/high availability
>>
>>  again, what is the problem here?
>
>Allowing two tunnels protecting the same addresses/hosts, but with differnt
>tunnel endpoints. Is this something allowed now?

I think the right question  here is how one would cause these 
different tunnels to be created in the first place. 2401bis is not 
explicit about how one determines the address for an SG, given the 
address of a host behind the SG. We note that this is a problem for 
which we do not have general answers. The new text on the PAD does 
address this a bit, but it is not comprehensive. My guess is that 
this is usually manually con figured into an implementation. In your 
case the question is whether an implementation allows for multiple SG 
addresses, and whether it causes a tunnel to be created to each of 
them when an SPD entry triggers SA creation. Currently this is 
largely outside the scope of 2401bis, i.e., it is up to vendors. One 
could add a sentence to the PAD text to say that support for creation 
of more than one tunnel mode SA at a time is OK (i.e., a MAY) just to 
clarify the issue.

Steve