Subject: Establishsing an IPsec SA between PaC and EP

From: "Mohan Parthasarathy" <[email-masked]>
Date: Thu, 20 Mar 2003 14:52:55 -0800

We discussed about creating an IPsec secutity association
between PaC and EP using PANA SA in the meeting. Following are some first
thoughts on this topic.

1) If PAA and EP are not co-located, need to discover the IP address of EP also
   so that an IPsec SA can be established.

2) If there are multiple EPs, pick one EP with which you want to establish an
   IPsec SA. Otherwise becomes a bit messy as you have to establish multiple
   SAs (implies that you discover all the EPs IP addresses).

3) The nodes (PaC and EP) need the ability to dynamically add SPDs ( which is 
   an implementation issue)

4) If you need to terminate the IPsec SA at the EP, you need two things :

	1) Use tunnel mode IPsec SA, as the PaC most likely would be sending packets
               that are destined to some other node in the internet. The outer header's
              destination address would be EP and inner destination address would be
	   the final destination.

	2) As all packets are being sent to EP (as an effect of terminating the
	   tunnel at EP), EP should be next hop default router i.e EP is the AR
	   itself.

5) We have to do double IPsec if the client is already using IPsec tunnel back to
   his/her coroporate network. This case may be more interesting and need lot of
   details on how SPD entries look like, how IKE works etc.

6) Need some details on what is exactly being passed on to EP. e.g., keys, identity
   information etc.

7) More details to think about..

---

From: "Ray Bell" <[email-masked]>
Date: Thu, 20 Mar 2003 18:22:26 -0800

Establishsing an IPsec SA between PaC and EP
  [Ray Bell] Some thoughts/response to your questions...

   -----Original Message-----
  From: Mohan Parthasarathy [mailto:[email-masked]]
  Sent: Thursday, March 20, 2003 2:53 PM
  To: [email-masked]
  Subject: Establishsing an IPsec SA between PaC and EP

  1) If PAA and EP are not co-located, need to discover the IP address of EP
also
     so that an IPsec SA can be established.
  [Ray Bell]  I assume you mean an IPSec SA between the PAA and EP (i.e.,
PaC<-->EP<-->PAA), which would require a two-step IPSec configuration to be
implemented: one SA between the PaC and EP, and one SA between the EP and
PAA.  Since IPSec Clients are common on most hosts, it may be more
simplistic to allow an IPSec SA between the PaC<-->SAA, where the EP is
configured to route IKE & IPSec.

  In terms of the either the "two-step" or "one-step" approach, the general
method for configuring IPSec on most implementations requires predefined SA
Peer relationships (configurations), which contain the IP Address as well as
the IKE & IPSec security & encryption configuration settings & key material
relevant to the specific peer. Some implementations support a "dynamic"
configuration which enables a "peer using a dynamic IP Address" to generate
a "run-time" SA Peer configuration.  So, I don't believe there is a
discovery issue.

  2) If there are multiple EPs, pick one EP with which you want to establish
an
     IPsec SA. Otherwise becomes a bit messy as you have to establish
multiple
     SAs (implies that you discover all the EPs IP addresses).
  [Ray Bell] Most IPSec implementations support multiple IPSec SA peer
relationships, and higher level packet filtering methods (generally based on
5 tuple filters) are used to determine which packet flow either establishes
an SA or gets bound to an existing SA.  If we want to look at automatic
failover between the EP and SAA, we may want to discuss using GRE/IPSec
methods.

  3) The nodes (PaC and EP) need the ability to dynamically add SPDs ( which
is
     an implementation issue)

          1) Use tunnel mode IPsec SA, as the PaC most likely would be
sending packets
                 that are destined to some other node in the internet. The
outer header's
                destination address would be EP and inner destination
address would be
             the final destination.
  [Ray Bell] If the PaC has a public IP Address, then you could use
transport mode.  Not sure of the issue you are pointing out.

          2) As all packets are being sent to EP (as an effect of
terminating the
             tunnel at EP), EP should be next hop default router i.e EP is
the AR
             itself.
  [Ray Bell] Not sure of the issue which you are pointing out.

  5) We have to do double IPsec if the client is already using IPsec tunnel
back to
     his/her coroporate network. This case may be more interesting and need
lot of
     details on how SPD entries look like, how IKE works etc.
  [Ray Bell] IPSec SAs are flow specific (generally based on five tuple
filter methods for dynamically setting-up the SA), so multiple SAs are the
norm.  The "Authentication SA" (PaC<-->EP<-->SAA  or PaC<-->SAA) may be
different than the "Enterprise VPN SA" (PaC<-->EP<-->Corporate_EP  or
PaC<-->Coroporate_EP).

  6) Need some details on what is exactly being passed on to EP. e.g., keys,
identity
     information etc.
  [Ray Bell] Not sure of the issue you are raising (IKE & IPSec materials?).

---

From: Julien Bournelle <[email-masked]>
Date: Fri, 21 Mar 2003 12:45:33 +0100

Hi,

> configured to route IKE & IPSec.

I guess that he means IPsec SA between the PaC and the EP. The issue
is that PaC need to discover the EP address to configure his IPsec SA.
A more general issue is to know if PANA would be in charge of configuring
such an SA. I think that it could be a nice feature.

-- 
[email-masked]

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 21 Mar 2003 10:49:15 -0500

> is that PaC need to discover the EP address to configure his IPsec SA.

There might be the following design choices to support EP discovery for 
establishing IPsec SA in the access network:

- IP address(es) of EP(s) are carried in PANA messages, for example, by 
  including EP-Address AVP(s) in PANA_success message.  This is possible 
  since PAA knows the location of EP(s).  

- Define a new ICMP Code for ICMP Error message that is sent from EP 
  to indicate the need for IPsec protection.  This requires some traffic 
  needs to be generated by PaC and captured by the EP.  I don't think 
  defining a new ICMP Error Code just to know the EP address is a good
  thing.

- Define a separate protocol for EP discovery.  I think this is not as
  easy as the first choise.

> such an SA. I think that it could be a nice feature.

Data-Protection AVP is defined for that purpose.  If a Data-Protection
AVP in included in PANA_success message and its flag indicates
network-layer ciphering, then it means PANA is in charge of enabling
IPsec SA between PaC and EP by using a standard protocol such as IKE
(and the IKE credential would be derived from the EAP Master Session
Key established as a result of successful PANA authentication).

Yoshihiro Ohba

---

From: Alper Yegin <[email-masked]>
Date: Fri, 21 Mar 2003 18:30:42 -0800

> easy as the first choise.

Here is another one:

- We can assume that when IPsec is used for data traffic authentication, any
access router on the same link as PaC can be used as EP. Hence a simple
router discovery can reveal the EPs.

> network-layer ciphering, then it means PANA is in charge of enabling

"PANA" is not in charge of establishing IPsec SA. PANA generates PANA SA,
and some protocol/mechanism will turn it into IPsec SA. I don't mean to be
too picky about the wording but, this is important to separate what PANA
protocol does from what it does not.

> Key established as a result of successful PANA authentication).

alper

---

From: Alper Yegin <[email-masked]>
Date: Fri, 21 Mar 2003 18:36:06 -0800

Thanks Mohan, for initiating this discussion.

comments inlined....

>  SAs (implies that you discover all the EPs IP addresses).

Discovering one or more EPs might not be significantly different.

If there are multiple ARs on a link, and ARs are used as EPs, then  I think
it is reasonable to enable PaC to establish IPsec SA with every one of them.
Of course it doesn't have to do that. It can choose to use a subset of them
as its default router.

>  details on how SPD entries look like, how IKE works etc.

I heard this before. Are there really issues here with double IPsec tunnels?
Is this a protocol issue, or an implementation issue?

alper

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 25 Mar 2003 18:19:55 -0500

> router discovery can reveal the EPs.

That would be the simplest one, I agree.

> protocol does from what it does not.

Yes, I meant some protocol/mechanism will turn the PANA SA into IPsec
SA.

Yoshihiro Ohba