Subject: Re: [Ipsec] questions about the traffic selector in IKEv2

From: "DIPANJAN DATTA" <[email-masked]>
Date: 14 Jun 2007 05:37:08 -0000

Hi,
TSi & TSr fields are applicable only when CHILD SAs are being created. CREATE_CHILD_SA is used to create subsequent CHILD SAs after the IKE SA is established. Hence the presence of TSi & TSr fields in a CREATE_CHILD_SA is self-explanatory and also this set of TSi & Tsr values are relevant only for this CHILD SA which is being created.
Now in IKE_AUTH exchange, the previous IKE_SA_INIT exchange is authenticated an hence the creation of the IKE SA , which was started in the IKE_SA_INIT exchange, is completed. Also during the IKE_AUTH exchange, creation of the first CHILD SA is piggybacked along with this creation of IKE SA. The TSi & TSr values present in the IKE_AUTH messages are meant for the creation of that particular CHILD SA and has no relation to the IKE SA being created or any other CHILD SA, as far as IKEv2 is concerned. Hence this set of TSi & TSr values have no bearing to the set of TSi & TSr values present in the CRETE_CHILD_SA exchange.

Regards
Dipanjan Datta

On Thu, 14 Jun 2007 fan zhao wrote :
>Hi,
>
>I have a question about the traffic selector in IKEv2.
>There are traffic selector fields, TSi and TSr in IKE_AUTH
>and CREATE_CHILD_SA message from the initiator.
>
>What is the relationship between the traffic selector fields in
>these different messages? In other words, TSi in IKE_AUTH
>is as same as TSi in CREATE_CHILD_SA or different or
>one is the subset of the other?
>
>Thank you very much.
>
>Sincerely,
>fan
>
>_______________________________________________
>Ipsec mailing list
>[email-masked]
>https://www1.ietf.org/mailman/listinfo/ipsec
_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: "fan zhao" <[email-masked]>
Date: Thu, 14 Jun 2007 11:17:52 -0700

Hi Dipanjan,

Thanks for your help.
Please see my reply in line.

On 14 Jun 2007 05:37:08 -0000, DIPANJAN DATTA <
[email-masked]> wrote:
>
> Hi,
> TSi & TSr fields are applicable only when CHILD SAs are being created.
> CREATE_CHILD_SA is used to create subsequent CHILD SAs after the IKE SA is
> established. Hence the presence of TSi & TSr fields in a CREATE_CHILD_SA is
> self-explanatory and also this set of TSi & Tsr values are relevant only for
> this CHILD SA which is being created.
>

OK.

 Now in IKE_AUTH exchange, the previous IKE_SA_INIT exchange is
> authenticated an hence the creation of the IKE SA , which was started in the
> IKE_SA_INIT exchange, is completed. Also during the IKE_AUTH exchange,
> creation of the first CHILD SA is piggybacked along with this creation of
> IKE SA.
>

OK. I see. Is creating a CHILD SA in the IKE_AUTH exchange optional? It
seems not, right?

Also, SAi1 and SAr1 in the IKE_SA_INIT are used to protect the following
message exchange
in the IKE_AUTH and the CREATE_CHILD_SA and they have nothing related with
SAi2 offer in the IKE_AUTH exchange and SA in the CREATE_CHILD_SA.
Do I understand correctly?

 The TSi & TSr values present in the IKE_AUTH messages are meant for the
> creation of that particular CHILD SA and has no relation to the IKE SA being
> created or any other CHILD SA, as far as IKEv2 is concerned. Hence this set
> of TSi & TSr values have no bearing to the set of TSi & TSr values present
> in the CRETE_CHILD_SA exchange.
>
OK.
If the responder only accepts a subset of the proposed traffic selectors,
does the initiator change its
SPD?

Thank you very much.

Sincerely,
fan

 Regards
>   <http://adworks.rediff.com/cgi-bin/AdWorks/click.cgi/www.rediff.com/signature-home.htm/1050715198@Middle5/1222036_1215847/1221230/1?PARTNER=3&OAS_QUERY=null+target=new+>