RE: 2401bis Issue #67 -- IPsec management traffic

[Stephen Kent <kent@bbn.com>]

At 12:40 -0700 9/16/03, Wenxiao He wrote:
>  > -----Original Message-----
>>  From: owner-ipsec@lists.tislabs.com
>>  [mailto:owner-ipsec@lists.tislabs.com] On Behalf Of Karen Seo
>>  Sent: Friday, September 12, 2003 5:27 PM
>>  To: ipsec mailingList
>>  Cc: byfraser@cisco.com; tytso@mit.edu; Angelos D. Keromytis;
>>  kivinen@ssh.fi; kseo@bbn.com
>>  Subject: 2401bis Issue #67 -- IPsec management traffic
>>
>>
>>  Folks,
>>
>>  Here's a description and proposed approach for:
>>
>>  IPsec Issue #:	67
>>
>>  Title:		IPsec management traffic
>>
>>  Description:
>>  ============
>>  SPD entries apply only to subscriber traffic. However, 2401 says that
>>  the "SPD must be consulted during the processing of all traffic..."
>>  leading to confusion about whether IPsec management traffic should
>>  have an SPD entry, etc.  Should the text be modified to make it clear
>>  that an IPsec implementation is able to send and receive traffic for
>>  itself independent of SPD/SAD entries or should there be an explicit
>>  SPD entry to cover IPsec management traffic?
>>
>
>When talking about "send and receive traffic for itself independent of
>SPD/SAD entries", are you saying all end host IPSec management traffic
>should be in cleartext?

NO. what we said was that IKE SAs are treated specially by the 
host/SG that terminates or originates IKE traffic, and thus need not 
be subject to SPD/SAD controls.

>Using the example below, assuming IPSec tunnel
>between H1 and SG2 is ready and H1 sending IKE messages to H2, should
>these IKE messages be in cleartext or protected  by H1/SG2 tunnel SA? On
>the 2nd note below are you saying when IKE traffic (H1/H2) going through
>SG2 it will require a SPD?

The IKE traffic from H1 is treated like any other subscriber traffic 
from H1, and thus requires an appropriate SPD entry to be allowed to 
pass. However, at H1, the IKE traffic it emits and receives need not 
be authorized by an entry in its SPD.

>
>         ======================================================
>         |                                                    |
>         |==============================                      |
>         ||                            |                      |
>         ||                         ---|----------------------|---
>         ||                         |  |                      |  |
>         H1* ----- (Internet) ------| SG2* ---- (Local ----- H2* |
>               ^                    |           Intranet)        |
>               |                    ------------------------------
>         could be dialup              admin. boundary (optional)
>         to PPP/ARA server
>
>
>>  Note: If one chose to allow IPsec management traffic to bypass SPD
>>  lookup, then how would one implement a policy of "don't accept IKE
>  > traffic from src A"?


Steve