IKEv2
Configuration Payload Integration
Darren Dukes, ddukes@cisco.com
Gregory Lebovitz, gregory@netscreen.com
http://www.vpnc.org/temp-draft-lebovitz-ipsec-scalable-ikev2cp-00.txt
Full presentation - http://www.employees.org/~ddukes
Agenda
IRAC Configuration Problem
The Configuration Payload
Private Pools
DHCP Assigned Addresses
RADIUS Assigned Addresses
The IRAC Configuration Problem
IPsec Remote Access Clients (IRACs) need to have a private IP address in order to specify TSi before creating CHILD-SAs.
How do we assign a unique IP address to the client before creating CHILD-SAs
The Configuration Payload
Allows an IRAC to acquire bootstrapping configuration within IKEv2 IKE_AUTH exchange
No extension of the IKE_AUTH exchange or new exchange (no "phase 1.5")
A generic mechanism to pass minimal bootstrapping parameters for CHILD-SA creation
May be used with any configuration server, such as DHCP, RADIUS, LDAP, etc.
IP Address Bootstrapping
CP(CFG_REQUEST) is sent by an IRAC in IKE_AUTH to request an IP address from an IPsec Remote Access Server (IRAS)
IRAS processes the CP(CFG_REQUEST) and assigns an address to the IRAC from internal or external configuration servers
IRAS sends a CP(CFG_REPLY) to IRAC with minimal IP address configuration so a CHILD-SA can establish.
CP and Private Pools
IKEv2 Message 3
IRAC (IKE-client)
IKE Gtwy
IRAS
HDR, SAi1, KEi, Ni
IKEv2 Message 1
IKEv2 Message 2
HDR, SAr1, KEr, Nr, [CERTREQ]
HDR, SK {IDi, [CERT,]
[CERTREQ,] [IDr,] CP(CFG_REQUEST),
SAi2, TSi, TSr}
HDR, SK {IDr, [CERT,]
AUTH, CP(CFG_REPLY),
SAr2, TSi, TSr }
IKEv2 Message 4
CFG_REPLY:

下一页