Subject: Re: [IPsec] hello,pls help us clarify what server will do，according RFC5685 if redirect times more than MAX_REDIRECTS，

From: vijay kn <[email-masked]>
Date: Wed, 18 Jun 2014 04:03:24 +0000

Dear Zengxin,

     In your case if the client is continuously getting redirected by original SeGW or the other gateways of the gateway pool, then it is better to configure a backup SeGW pool on the base station.
I mean if the below abnormal case is met then the base station should have the intelligence to sense the LOOP and should have a fallback approach in connecting to a backup SeGW which will definitely establish tunnel with the base station.
Later the client can connect back with the “Master SeGW/intended SeGW by using appropriate retry with original-SeGW” and gracefully delete the tunnel with the Slave SeGW.

This leads to a scenario of REDIRECT and Master-SLAVE gateway feature co-existence at the base station.

NOTE: -
The below scenario is a very rare scenario that can happen.

From: Zengxin (Ryan)
Sent: Wednesday, June 18, 2014 9:20 AM
To: [email-masked]; [email-masked]; [email-masked]
Cc: Shenwenbin; dharmanandana pothulam; [email-masked]; Fangongbin (Allan); vijay kn; Liujun (Leo, FW-IPSec)
Subject: hello,pls help us clarify what server will do，according RFC5685 if redirect times more than MAX_REDIRECTS，

Dear Vijay Devarapalli & Kilian Weniger:
    We are from huawei, now implementing IKEv2 Redirect Featrue  according to RFC5685. But in some abnormal case, can u explain more about what action next.

RFC5685
7.  Handling Redirect Loops

   The client could end up getting redirected multiple times in a
   sequence, either because of a wrong configuration or a DoS attack.
   The client could even end up in a loop with two or more gateways
   redirecting the client to each other.  This could deny service to the
   client.  To prevent this, the client SHOULD be configured to not
   accept more than a certain number of redirects (MAX_REDIRECTS) within
   a short time period (REDIRECT_LOOP_DETECT_PERIOD) for a particular
   IKEv2 SA setup.

if redirect time is more than MAX_REDIRECTS(define for Handling Redirect Loops), we don’t know what the action the server will do , to make sure our negotiate can be succeed.
       (1) After client ignore the redirect payload sent from A-GW(a selected GW), if client continue to negotiates with A-GW, A-GW maybe still send redirect payload to client.
    At this time, client will ignore the payload again and repeat the steps mentioned before. So the the negotiation will have no chance to be success.

   (2) After client ignore the redirect payload sent from A-GW(a selected GW), if client negotiates with the initial GW, which maybe also send redirect payload as the step (1)
    So same as (1), we can't make sure whether the negotiation will be success or not

Best Regards,

Cyber Security Solutions Design Dept
Zeng Xin
________________________________
Huawei Technologies Co., Ltd.
Phone: 86-21-38900743
Mobile: 15900686919
Email: [email-masked]<mailto:[email-masked]>
No.2222, Xinjinqiao Rd., Pudong District,Shanghai 201206, P.R.China
http://www.huawei.com<http://www.huawei.com/>