Subject: [AAA-WG]: Ipsec Usage in DIAMETER

From: "Antonio Forzieri" <[email-masked]>
Date: Mon, 18 Nov 2002 10:42:30 +0100

Hi,
  I have a question on the Ipsec usage under DIAMETER...

What I can't really understand is where IPsec should be used.
Suppose we have the folllowing scenario:

                                       +-----+
                                       |     |
                                    +--| DIA |
       +-----+            +-----+   |  |     |
       |     |    PSTN    |     |   |  +-----+
       | Joe |------------| NAS |---|
       |     |            |     |   |
       +-----+            +-----+   |  +-----+
     IP.valid.ip.2                  |  |     |
                                    +--|Targ.|
                                       |     |
                                       +-----+
                                      IP.valid.ip.1

In this scenario Joe tries to authenticate himself using the diameter server.
Once Joe is authenticated I would like that traffic between Joe and the target will be secured using Ipsec.
Can Diameter (NAS) negotiate an Ipsec tunnel between Joe and Target or Ipsec is just used between NAS and the target to
establish  a  secure  tunnel  for the user?
Can Diameter be used as a kind of PIC (Pre-IKE Credential Provisioning Protocol)?
Is there any document (draft, rfc, thesis, article...) about this topic?

---

From: Bernard Aboba <[email-masked]>
Date: Mon, 18 Nov 2002 03:08:27 -0800 (PST)

Via Tunnel attributes it is possible for the Diameter server to specify a
compulsory IPsec tunnel (or other types of tunnels) to be brought up
between the NAS and the Target. But if you want a tunnel between Joe and the Target then
that is "voluntary tunneling" which is the responsibility of the end
systems.