Subject: Re: [sacm] IPsec SA overview

From: Kathleen Moriarty <[email-masked]>
Date: Sun, 8 Feb 2015 11:13:45 -0500

Sorry, this was sitting in my outbox unsent.

Hello,

Sent from my iPhone

> On Jan 30, 2015, at 7:39 AM, "Lorenzin, Lisa" <[email-masked]> wrote:
> 
> Greetings!
> 
> Henk's note on 802.1AR (which is very clear and concise - thank you, Henk!) reminds me that I had the action item to summarize an IPsec SA.
> 
> An IPsec security association (SA) is composed of a collection of parameters - including destination address, keys, IPsec transforms, etc.) - that describe how to set up an IPsec tunnel between two endpoints. SAs are one-way, so in order to establish an IPsec tunnel between two peers, each peer must create an SA representing its communication with the other.

If the WG chooses to use IPsec SAs, please use existing definitions for this term since IPsec is an IETF protocol.  I'm on a plane, so I can't look up the reference at the moment.  It may be in RFC4949 or I'm sure you'll find it in an IPsec RFC.

Thanks,
Kathleen
> 
> The reason I suggested IPsec SA as a possible endpoint identity attribute is because Pulse Secure & Juniper use IPsec SAs as one way to identify endpoint traffic passing through a firewall acting as an L3 enforcement point.  The simplest way to identify the sending endpoint is by source IP address; however, this breaks if there is a NAT between endpoint and policy server, or between endpoint and enforcer firewall.  Using an IPsec SA (which the client communicates to the policy server, and the endpoint uses to form an IPsec tunnel with the firewall) ensures that the policy server and firewall can mutually identify the same endpoint even if the endpoint communicates with the policy server on a different IP address than it communicates with the firewall.
> 
> Upon reflection, I don't think that an IPsec SA is suitable as a primary endpoint identity attribute for SACM because it is session-specific, not endpoint specific.  However, it could still be a useful endpoint attribute to capture (if possible) since it does reflect a unique characteristic of the endpoint.
> 
> Regards,
> Lisa
> 
> -- 
> Lisa Lorenzin    /    Principal Solutions Architect
> [email-masked]    /    919-384-7275
> Pulse Secure    /    https://www.pulsesecure.net
> 
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm