Subject: AW: IPSRA WG LAST CALL: draft-ietf-ipsec-dhcp-08.txt

From: Bungert Michael <[email-masked]>
Date: Fri, 8 Dec 2000 15:08:03 +0100

Hi Bernard,

thank you for your quick response. I'm not convinced that the QM IDs are the appropriate solution for the binding of newly assigned address and QM SA. It is my understanding that the QM IDs should be used to determine the security requirements for the association based on the security policy and I'm not sure if these assigned addresses are always appropriate for that. Moreover, since the SGW learns the address assigned to the client during the DHCP SA the information is already available.

Michael  

> -----Urspr> üngliche Nachricht-----
> Von:	Bernard Aboba [SMTP:[email-masked]]
> Gesendet am:	Freitag, 8. Dezember 2000 08:36
> An:	Bungert Michael; [email-masked]
> Betreff:	RE: IPSRA WG LAST CALL: draft-ietf-ipsec-dhcp-08.txt
> 
> I think it is a MUST (thanks for catching the error). The idea was
> to make sure that there is a binding between the newly assigned
> address and the QM SA.
> 
> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Bungert Michael
> Sent: Thursday, December 07, 2000 1:26 AM
> To: [email-masked]
> Subject: AW: IPSRA WG LAST CALL: draft-ietf-ipsec-dhcp-08.txt
> 
> 
> Two questions on the dhcp draft:
> On pg. 7 the draft says: If a new IPSEC tunnel is required, the remote host
> establishes
>    a tunnel mode SA to the security gateway in a quick mode exchange.
>    In this case, the new address assigned via DHCPv4 MUST be used
>    in the quick mode ID.
> On pg. 10: After processing of the DHCPACK, the intranet interface is
> configured
> and the internet interface can establish a new IPSEC tunnel mode SA to
> the security gateway. The IDci of the quick mode exchange used to
> establish the new IPSEC tunnel mode SA should be the address of the
> intranet interface as obtained via DHCPv4.
> 
> Questions: Is it a MUST or a should and why is it a MUST/a should ?
> 
> Michael
> 
> 
> > -----Urspr> üngliche Nachricht-----
> > Von:	Paul Hoffman / VPNC [SMTP:[email-masked]]
> > Gesendet am:	Mittwoch, 29. November 2000 18:02
> > An:	[email-masked]
> > Betreff:	IPSRA WG LAST CALL: draft-ietf-ipsec-dhcp-08.txt
> >
> > This is the beginning of a three-week WG last call on
> > draft-ietf-ipsec-dhcp-08.txt. You can find a copy at
> > <http://www.ietf.org/internet-drafts/draft-ietf-ipsec-dhcp-08.txt>.
> >
> > This draft will be discussed in San Diego, but it would be really
> > grand if everyone can look at it sooner and comment on the mailing
> > list. Doing so will make the discussion in San Diego more focused,
> > and allows the authors to respond to requests for changes both on the
> > list and in the face-to-face meeting.
> >
> > And, for those of you who are sticklers on procedure, this draft is
> > not officially part of the IPSRA WG work, but it has been
> > unofficially moved to us because of its content. This is a minor
> > status issue and will not affect our discussion nor its eventual
> > standardization status.
> >
> > --Paul Hoffman, Director
> > --VPN Consortium

---

From: "Bernard Aboba" <[email-masked]>
Date: Fri, 8 Dec 2000 11:20:20 -0800

Well, the other alternative is to use the Internet address used in the outer
header.
Are you suggesting that the assigned address SHOULD be used? MAY be used?

Anyone else have an argument one way or the other?

-----Original Message-----
From: Bungert Michael [mailto:[email-masked]]
Sent: Friday, December 08, 2000 6:08 AM
To: 'Bernard Aboba'
Cc: [email-masked]
Subject: AW: IPSRA WG LAST CALL: draft-ietf-ipsec-dhcp-08.txt

Hi Bernard,

thank you for your quick response. I'm not convinced that the QM IDs are the
appropriate solution for the binding of newly assigned address and QM SA. It
is my understanding that the QM IDs should be used to determine the security
requirements for the association based on the security policy and I'm not
sure if these assigned addresses are always appropriate for that. Moreover,
since the SGW learns the address assigned to the client during the DHCP SA
the information is already available.

Michael

---

From: "Scott G. Kelly" <[email-masked]>
Date: Fri, 08 Dec 2000 14:17:26 -0800

Hi Michael,

Bungert Michael wrote:
> appropriate solution for the binding of newly assigned address and QM SA. It is
> my understanding that the QM IDs should be used to determine the security
> requirements for the association based on the security policy and I'm not sure
> if these assigned addresses are always appropriate for that. Moreover, since
> the SGW learns the address assigned to the client during the DHCP SA the
> information is already available.
> 
> Michael

While I agree in principle that the qm id could be used to determine the
security attributes of the phase 2 sa, in practice it is the phase 1 IDs
which are used for this. Typically, current implementations use flow
identifiers as the phase 2 IDs.

Scott