Subject: [Ipsec] RFC 3715 / IPsec NAT Compatibility

From: "Bob Arthurs" <[email-masked]>
Date: Sat, 03 Jul 2004 17:34:22 +0000

Hi Folks,

Quick question about RFC 3715 - on page 4 (c) the RFC mentions 
incompatibility between IKE address identifiers and NAT.

Would I be right in saying that this incompatibility occurs only in 
transport mode when using IP addresses as phase 1 identifiers, and when the 
source address of ISAKMP packets is checked against the traffic selectors 
carried as identifiers in phase 2 ?? Or have I completely missed the point 
:)

Many thanks in advance.

_________________________________________________________________
Express yourself with cool new emoticons http://www.msn.co.uk/specials/myemo

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Kevin Li <[email-masked]>
Date: Wed, 07 Jul 2004 16:58:49 -0700

Hi,

Does IKEv2 have similar limitation?
I.e. IP address shouldn't be used as the identifier when there is NAT.

BTW, why such limitation while IKE has the authentication in place?

Thanks.

Kevin Li

================== Quote from RFC3715/page 4/(c)

   c) Incompatibility between IKE address identifiers and NAT.  Where IP
      addresses are used as identifiers in Internet Key Exchange
      Protocol (IKE) Phase 1 [RFC2409] or Phase 2, modification of the
      IP source or destination addresses by NATs or reverse NATs will
      result in a mismatch between the identifiers and the addresses in
      the IP header.  As described in [RFC2409], IKE implementations are
      required to discard such packets.
      ...

Bob Arthurs wrote:

> transport mode when using IP addresses as phase 1 identifiers, and 
> when the source address of ISAKMP packets is checked against the 
> traffic selectors carried as identifiers in phase 2 ?? Or have I 
> completely missed the point :)
>
> Many thanks in advance.

---

From: Geoffrey Huang <[email-masked]>
Date: Wed, 07 Jul 2004 21:42:09 -0700

> I.e. IP address shouldn't be used as the identifier when there is NAT.

The problem is you won't always know there's a NAT between you and the peer.

> BTW, why such limitation while IKE has the authentication in place?

IKE ties some authentication material to an identity.  In some cases, the 
identity can be an IP address.  The problem occurs when the address changes 
unexpectedly (as is the case when NAT is involved).

-g