Subject: Resending: Partha (fwd): policy expressive power in IPSec-VPN policy draft

From: "R. Rajan" <[email-masked]>
Date: Thu, 11 Mar 1999 13:14:46 -0500

I apologize for the earlier html message. Resending the message in plain
text.

raju rajan

-----Original Message-----
From: Partha P. Bhattacharya <[email-masked]>
To: [email-masked] <[email-masked]>
Date: Thursday, March 11, 1999 11:43 AM
Subject: Fw: policy expressive power in IPSec-VPN policy draft

Raju: My message to [email-masked] bounced back. Why do you think?
Could you post it.
Thanks. Partha

-----Original Message-----
From: Partha P. Bhattacharya <[email-masked]>
To: [email-masked]' <[email-masked]'>
Cc: [email-masked] <[email-masked]>
Date: Wednesday, March 10, 1999 10:42 PM
Subject: policy expressive power in IPSec-VPN policy draft

Ricky:

In short, the LDAP VPN policy schema draft
    draft-ietf-ipsec-vpn-policy-schema-00.txt
provides the full policy expressive power as required by IPSec.

The basic version of an IPSec (data protection) policy as described in the
draft
consists of
   - one PolicyCondition object and
   - one IPSecSecurityAction object
  - one ISAKMPAction object

The IPSecSecurityAction object  consists of tunnel end point descriptions
and
a list of IPSecProposal objects (semantics between multiple proposals is
logical OR).
The preference can be  ndicated by doing "n:DN".

Each proposal is an IPSec transform set; it consist of
 - a list of AH transforms,
 - optionally a list of ESP transforms and
 - optionally a list of  IPCOMP transforms.

AH, ESP and IPCOMP  transform objects are represented as
IPSecTransform objects (it includes a type that indicates what protocol
it corresponds to).

If multiple AH (resp. ESP, IPCOMP) transforms are present in the same
IPSec proposal then the semantics is logical OR. The preference can be
indicated by doing "n:DN".

The semantics of any combination of AH, ESP and IPCOMP protocols in an
IPSec proposal is logical AND.

Consider the following multi-proposal example, suppose your policy is
 - if HTTP to dest 1.1.1.* then
- do ipsec and negotiate two proposals
     - either ESP= 3DES, SHA and AH = SHA  or MD5 (first preference)
    -  or  EPS = DES, SHA (second preference)

Policy:

   - PolicyConditionRef ---------> PolicyCondition object (proto= HTTP,
destAddr = 1.1.1.X)
   - IPSecSecurityAction
             --------->IPSecProposal obj
                               attr:  AHTransformRef -------->IPSecTransform
obj (attrib. AHProtocol = SHA)
                                                               -------->IPSe
cTransform obj (attrib. AHProtocol = MD5)

                               attr: ESPTransformRef------->IPSecTransform
obj (attrib ESPCipher = 3DES, ESPAuth = SHA)

             ---------->IPSecProposal obj
                               attr: ESPTransformRef------->IPSecTransform
obj (attrib ESPCipher = DES, ESPAuth = SHA)

Hope this answers your question.

Partha P. Bhattacharya
Internet Services Management Group
Cisco Systems
255 Tasman Drive
San Jose CA 95134