I saw in several places online that the different between IKEv1 and IKEv2 is the use of multiple combinations of a source IP range as left and right subnets (locally and remote), a destination IP range, a source port range and a destination port range are allowed per Child SA. I am using Strongswan 5.3.5 version on Ubuntu 16.4 LTE.
$\begingroup$
$\endgroup$
0
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
No, IKEv1 does not support negotiating multiple combinations of source IP ranges (or subnets) within a single SA.
The IKEv1 RFCs (specifically, 2407 and 2409) constrain the negotiated source IP to be either a single IP address, or an IP subnet (that is, an IP address and a mask; this is typically used to handle things such as 10.0.0.0/8; it can also handle "any" IP address) [1]. As for ports, you can ask for a specific port, or any port; nothing inbetween is allowed. And, no, a single SA cannot have multiple; if you need to protect multiple subnets, you need to negotiate separate SAs.
It is possible that the Strongswan implementation of IKEv1 attempts to go beyond what the RFC permits (at least, when negotiating with other Strongswan implementations); however, I personally find that unlikely
[1]: Note: this is a subnet, not a range; it can't negotiate, say 10.0.0.1-10.0.0.6; the closest you can do is 10.0.0.0/29 (which also covers 10.0.0.0 and 10.0.0.7). It could negotiate "discontiguous" subnets, such as 10.0.X.1 (for any X); I wouldn't be surprised if many IKEv1 implementations didn't support such an oddball thing...
