Re: [Seamoby] CAR DiscoveryProtocol Requirements...

"Hesham Soliman (ERA)" wrote:
> 
> [reply for a very old mail]
> 
>   > can you make IKE create an SA between two nodes (one having
>   > a public address and another having a private address)?
> 
> => Yes you can. There are IKE extensions for this.

which RFC?? 

---------------

from Aboba's draft draft-ietf-ipsec-nat-reqts-00.txt

c) Incompatibility between IKE address identifiers and NAT.
   Where IP addresses are used as identifiers in IKE MM [7]
   or QM, modification of the IP source or destination
   addresses by NATs or reverse NATs will result in a
   mismatch between the identifiers and the addresses in the
   IP header. As described in [7], IKE implementations are
   required to discard such packets.

   In order to avoid use of IP addresses as IKE MM and QM identifiers,
   userIDs and FQDNs can be used instead. Where user authentication
   is desired, an ID type of ID_USER_FQDN can be used, as described in
   [5]. Where machine authentication is desired, an ID type of ID_FQDN
   can be used. In either case it is necessary to verify that the
   proposed identity matches that enclosed in the certificate.
   However, while use of USER_FQDN or FQDN identity types is possible
   within IKE, there are usage scenarios (e.g. SPD entries
   describing subnets) that cannot be accommodated this way.

------------------

However there are a couple of internet drafts in the IPSec WG
dealing with this. Hopefully they will have a solution soon.

If I am missing something, let me know.

Vijay

> I'm obviously not interested in anything involving
> private addresses, but your point is incorrect.
> 
> Hesham

_______________________________________________
Seamoby mailing list
Seamoby@ietf.org
https://www1.ietf.org/mailman/listinfo/seamoby