Subject: [Ipsec] OT: Basic questions on IPSec SAs/tunnel/ESP & AH auth

From: "Bob Arthurs" <[email-masked]>
Date: Fri, 11 Jun 2004 09:13:37 +0000

hi guys,

I am researching IPSec, and on reading many VPN related IPSec 
RFCs/drafts/books I have got one or two fairly basic questions (sorry if 
this is the wrong list for them).

I'd really appreciate any help on these questions:

1. My understanding is that an IPSec *tunnel* is made up of two 
(undirectional) IPSec SAs. Am I correct?  (there seems some ambiguity on 
this point especially in some IPSec related books).

2. I know that in IKEv1 is not possible to negotiate IPSec SAs with 
identical traffic selectors, but in IKEv2 I see that it is possible. So, if 
I understand this correctly you could therefore have more that one tunnel 
(pair of unidrectional IPSec SAs) between two peers in an IPSec VPN (one 
tunnel for each seperate QoS [to prevent possible replay protection traffic 
drops], for example). Is this correct?

3. Obviously authentication can be provided by both AH and ESP. I notice 
that on some vendors' equipment it is possible to configure *both* AH and 
ESP auth for a single (pair of) IPSec SAs (1 ipsec tunnel). I have 2 
questions about this:

a. this seems to permissable in the IPSec RFCs/drafts that I have read. Am I 
correct?

b. BUT, there seems absolutely no *practical* point in having both AH and 
ESP auth for 1 IPSec tunnel. Am I correct on this point?

many thanks in advance for answering my questions!

_________________________________________________________________
Stay in touch with absent friends - get MSN Messenger 
http://www.msn.co.uk/messenger

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Bill Sommerfeld <[email-masked]>
Date: Fri, 11 Jun 2004 11:37:24 -0400

> this point especially in some IPSec related books).

This seems to be semi-common usage but strikes me as sloppy.

IPsec SA's are unidirectional; each direction requires one or more
SA's to protect it.

The way I look at it:

 - A tunnel is an artifact of policy.

 - SA's should have a limited lifetime (for numerous cryptographic
   reasons) and therefore should be thought of as ephemeral, 

 - the policy which caused the SA's to be created is persistant.

SA's can also directly protect application traffic without the
introduction of a new IP header (transport mode).

> drops], for example). Is this correct?

Under 2401bis, the sender may have more than SA's to choose from; this
may be presented in administrative interfaces as as multiple tunnels
or as single tunnel.

> a. this seems to permissable in the IPSec RFCs/drafts that I have read. Am I 

Yes.

> ESP auth for 1 IPSec tunnel. Am I correct on this point?

Yes.  It's pointless in practice, and leads to needless confusion.

						- Bill

---

From: Uri Blumenthal <[email-masked]>
Date: Fri, 11 Jun 2004 12:18:52 -0400

> this is the wrong list for them).

Bob, the answer to all of the questions you've posted is "yes".

---

From: Michael Richardson <[email-masked]>
Date: Fri, 11 Jun 2004 13:18:36 -0400

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Bob" == Bob Arthurs <[email-masked]> writes:
    Bob> 1. My understanding is that an IPSec *tunnel* is made up of two
    Bob> (undirectional) IPSec SAs. Am I correct?  (there seems some
    Bob> ambiguity on this point especially in some IPSec related
    Bob> books).

  I don't think many of us call that thing a "tunnel". Tunnel is a
superset of a pair of unidirectional IPsec SAs. (Transport mode is similar)

    Bob> 2. I know that in IKEv1 is not possible to negotiate IPSec SAs
    Bob> with identical traffic selectors, but in IKEv2 I see that it is
    Bob> possible. So, if I understand this correctly you could
    Bob> therefore have more that one tunnel (pair of unidrectional
    Bob> IPSec SAs) between two peers in an IPSec VPN (one tunnel for
    Bob> each seperate QoS [to prevent possible replay protection
    Bob> traffic drops], for example). Is this correct?

  Yes. QoS is one of many reasons to do this.

    Bob> 3. Obviously authentication can be provided by both AH and
    Bob> ESP. I notice that on some vendors' equipment it is possible to
    Bob> configure *both* AH and ESP auth for a single (pair of) IPSec
    Bob> SAs (1 ipsec tunnel). I have 2 questions about this:

    Bob> a. this seems to permissable in the IPSec RFCs/drafts that I
    Bob> have read. Am I correct?

  Yes, but generally not sensible unless the end-points of the two SAs
are different.

    Bob> b. BUT, there seems absolutely no *practical* point in having
    Bob> both AH and ESP auth for 1 IPSec tunnel. Am I correct on this
    Bob> point?

  Given identical end-points, it would be silly, yes.

- --
]     "Elmo went to the wrong fundraiser" - The Simpson         |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] [email-masked]      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [