[Mip6] Reg. IPsec configuration for Payloads in TAHI testsuite

"O.L.N.Rao" <olnrao@samsung.com> Fri, 30 January 2004 05:39 UTC

Date: Fri, 30 Jan 2004 11:02:12 +0530
From: "O.L.N.Rao" <olnrao@samsung.com>
To: mip6@ietf.org
Message-id: <015e01c3e6f2$6bd3c2a0$7a476c6b@sisodomain.com>
MIME-version: 1.0
Content-type: multipart/alternative; boundary="Boundary_(ID_ZBgGPJ1Ry0yqrbsZyhdBcw)"
Subject: [Mip6] Reg. IPsec configuration for Payloads in TAHI testsuite
Sender: mip6-admin@ietf.org
Errors-To: mip6-admin@ietf.org
Precedence: bulk

Hello,

    Your TAHI MIPv6 CT suit is really very much helpful
    to carefully understand each and every line (even word)
    of Draft-24.

    I am currently working with 2.0.5 release.  In which
    there is a IPsec configuration for Payload packets to & from MN.

    When enabled IPSEC_* to YES:

    TN sends Echo Request with ESP applied twice once in each mode.
    First in Transport Mode with SPI 2009.  Then with Tunnel Mode with
    SPI 2007.  

    When NUT receives this packet, it could find 2007 SPI in its Policy DB
    and could decrypt and decapsulate.  However, when trying to find
    the policy for SPI 2009, it fails.  Because, currently our IPsec
    can not be applied differently for each ICMPv6 message type.  We can
    only apply per protocol basis.  So, what ever is configured for Prefix Discovery    
    automatically covers all the ICMPv6 packets.  Becuase SPDs 
    are ordered, the Payload polilcy configuration is applicable only to 
    non-MIPv6 and non-ICMPv6 packets.  Also, in the configuration for MN
    is with spi_e is not clear to me.  It has two values ??


    Let me know whether my understanding is correct, (that is Policy given is per
    ICMPv6 message type.  And, MPS & MPA need one policy and all others need
    another policy).


   Following snip is from the draft : draft-ietf-mobileip-mipv6-ha-ipsec-06.txt 
   5.2.3 Prefix Discovery
   In the following we describe some additional SPD and SAD entries to
   protect prefix discovery.  Note that the SPDs described above protect
   all ICMPv6 traffic between the mobile node and the home agent, as
   IPsec may not have the ability to distinguish between different
   ICMPv6 types. 


    This is true with our IPsec implementaion.  Also to note, payload protection is
    MAY in the draft.  Where as all others are MUST + SHOULD combination.
    I tried to make IPSEC_PAYLOAD* NO and run the script.  Then, TN sends
    Echo Request in plain text (not applied with any IPsec policy).  But as per
    the order of poicies, it SHOULD have been applied with Prefix Discovery policy
    as it covers all ICMPv6 packets (Again this statement is only applicable if
    your TAHI ipsec scripts work per protocol basis, and not per icmp message type).


    Your clarification in this regard is very much helpful for us to proceed.

    Thanks in advance.



Regards,
O.L.N.Rao

[Mip6] Reg. IPsec configuration for Payloads in T… O.L.N.Rao