Subject: [Ipsec] Public IP address & IP mobility

From: "Rajeev Gupta" <[email-masked]>
Date: Sun, 22 Aug 2004 20:37:38 -0700

Would appreciate if someone can reply to these 2 questions relating to
IKEv2:
 
(the tunnel initiator is referred to as "client" and the tunnel
terminator is the "gateway")
 
-          is it possible for the client to learn its public IP address
as seen by the gateway? The current NAT detection mechanism in IKEv2
only provides to the client the hash of its public IP address as seen by
the gateway - why not the actual IP address itself? 
 
-          Is it possible for the client to maintain the IPSec tunnel
with the gateway, if it changes its source IP address? This could happen
if the client moves across subnets in a wireless network. Is there any
specified mechanism to use Mobile IP with IPSec?
 
Thanks.
 
Rajeev Gupta
 
_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Radia Perlman <[email-masked]>
Date: Sun, 22 Aug 2004 22:15:00 -0700

Rajeev Gupta wrote:

> (the tunnel initiator is referred to as “client” and the tunnel 
> terminator is the “gateway”)
>
> - is it possible for the client to learn its public IP address as seen 
> by the gateway? The current NAT detection mechanism in IKEv2 only 
> provides to the client the hash of its public IP address as seen by 
> the gateway – why not the actual IP address itself?
>
You are correct. In message 2 the gateway only sends the hash. This 
design was copied
from the design for NAT detection in IKEv1 since people seemed happy 
with it. I probably
would have sent the actual address rather than a hash, but I guess 
people thought it was
good for some sort of secrecy to hide the actual IP address. Given that 
in IPv4, addresses
are only 32 bits, it wouldn't take much work to find a set of addresses 
that hash to that
value, so I'm not sure how useful it is to send the hash rather than the 
address.

> - Is it possible for the client to maintain the IPSec tunnel with the 
> gateway, if it changes its source IP address? This could happen if the 
> client moves across subnets in a wireless network. Is there any 
This is the problem that the mobeike WG is working on.
http://www.ietf.org/html.charters/mobike-charter.html

Radia

---

From: Jari Arkko <[email-masked]>
Date: Mon, 23 Aug 2004 13:20:21 +0300

Hi Rajeev,

Here's a few responses to your questions:

(a) My understanding is that the NAT-T functionality does indeed not
     allow you to discover your public IP address. (But where
     do you need that info? There may be other IETF protocols that
     can do this discovery for you if you really need it. For mobility
     you don't necessarily need it.)

(b) If you have IKEv2 and NAT-T, the client can actually move
     around, as NAT-T learns the new client address and can change
     that dynamically.

(c) MOBIKE WG is looking into a protocol extension to IKEv2 that
     would enable client address changes even when you are not using
     a NAT, enables multiple simultaneous addresses (multihoming),
     security against spoofed new addresses, etc.

(d) Mobile IP can also work together with IPsec, with the introduction
     of a server called the home agent in the network. See RFC 3775
     for details of the IPv6 case.

Hope this helps,

Jari

Rajeev Gupta wrote:
> */Rajeev Gupta/**//*
> ------------------------------------------------------------------------
>

---

From: Tero Kivinen <[email-masked]>
Date: Mon, 23 Aug 2004 13:29:18 +0300

Radia Perlman writes:
> design was copied from the design for NAT detection in IKEv1 since
> people seemed happy with it. I probably would have sent the actual
> address rather than a hash, but I guess people thought it was good
> for some sort of secrecy to hide the actual IP address. Given that
> in IPv4, addresses are only 32 bits, it wouldn't take much work to
> find a set of addresses that hash to that value, so I'm not sure how
> useful it is to send the hash rather than the address.

I agree that for IPv4 it is not really have real security, but for
IPv6 there might be some real protection. Remember also that 64-bits
of the IPv6 address are mostly tied to the machine, meaning even when
the prefix changed, the lower 64-bits would stay same.

Also some people put NATs in their firewalls, just to keep the
internal IP-addresses hidden, thus sending them out *in clear* with
all IKE negotiation, would be quite bad from their point of view.

Adding hashing there is quite cheap way to keep those people happy,
and for NAT-T we do not care what the IP-addresses originally ware, we
care that there was NAT between modifying them.
-- 
[email-masked]

---

From: "Srinivasa Rao Addepalli" <[email-masked]>
Date: Sun, 22 Aug 2004 22:48:02 -0700

Hi  Rajeev,
     
     By maintaining constant internal IP address (Typically private IP address, assigned by
     the gateway) in tunnel mode, it is possible to have same  IPSec SA, even if the IP address
     of client changes, when it moves from one AP (Or AC) to another AP (Or AC). 

     Following methods are followed:
     1. Client noticing that its interface IP address is changed and deleting and reestablishing
         both IPSec and IKE SAs. Yet times, this is not good enough and may not would like to
         have delay in sending the packets.
     2. Client changes the IP address of SAs (inbound and outbound) to new IP address.
         Server (Gateway) noticing the source  IP address change in the data packets and if the data packet
         is successfully decrypted/authenticated, changes the IP address in corresponding outbound
         SA (Note that, typically inbound SA is selected based on DIP, SPI, Protocol). 

     To address above and even more generic problems, MOBIKE group is formed in IETF and would be
     addressing these kind of problems.

Srini

----- Original Message ----- 
  From: Rajeev Gupta 
  To: [email-masked] 
  Sent: Sunday, August 22, 2004 8:37 PM
  Subject: [Ipsec] Public IP address & IP mobility

  Would appreciate if someone can reply to these 2 questions relating to IKEv2:

  (the tunnel initiator is referred to as "client" and the tunnel terminator is the "gateway")

  -          is it possible for the client to learn its public IP address as seen by the gateway? The current NAT detection mechanism in IKEv2 only provides to the client the hash of its public IP address as seen by the gateway - why not the actual IP address itself? 

  -          Is it possible for the client to maintain the IPSec tunnel with the gateway, if it changes its source IP address? This could happen if the client moves across subnets in a wireless network. Is there any specified mechanism to use Mobile IP with IPSec?

  Thanks.

  Rajeev Gupta

------------------------------------------------------------------------------