附录 C. 交换与载荷

本附录简要概述了 IKEv2 的交换，以及哪些载荷可以出现在哪些消息中。 本附录纯属资料性内容；若其与本文正文存在冲突，则以其他文本为准。

厂商 ID（V）载荷可以包含在任何消息的任意位置。此处所列顺序表示了 它们最合乎逻辑的位置。

C.1. IKE_SA_INIT 交换

request --> [N(COOKIE)], SA, KE, Ni, [N(NAT_DETECTION_SOURCE_IP)+, N(NAT_DETECTION_DESTINATION_IP)], [V+][N+]

normal response <-- SA, KE, Nr, （无 cookie） [N(NAT_DETECTION_SOURCE_IP), N(NAT_DETECTION_DESTINATION_IP)], [[N(HTTP_CERT_LOOKUP_SUPPORTED)], CERTREQ+], [V+][N+]

cookie response <-- N(COOKIE), [V+][N+]

不同的 Diffie- <-- N(INVALID_KE_PAYLOAD), Hellman 群 [V+][N+] 不一致

C.2. 不含 EAP 的 IKE_AUTH 交换

request --> IDi, [CERT+], [N(INITIAL_CONTACT)], [[N(HTTP_CERT_LOOKUP_SUPPORTED)], CERTREQ+], [IDr], AUTH, [CP(CFG_REQUEST)], [N(IPCOMP_SUPPORTED)+], [N(USE_TRANSPORT_MODE)], [N(ESP_TFC_PADDING_NOT_SUPPORTED)], [N(NON_FIRST_FRAGMENTS_ALSO)], SA, TSi, TSr, [V+][N+]

response <-- IDr, [CERT+], AUTH, [CP(CFG_REPLY)], [N(IPCOMP_SUPPORTED)], [N(USE_TRANSPORT_MODE)], [N(ESP_TFC_PADDING_NOT_SUPPORTED)], [N(NON_FIRST_FRAGMENTS_ALSO)], SA, TSi, TSr, [N(ADDITIONAL_TS_POSSIBLE)], [V+][N+]

子 SA 创建 <-- IDr, [CERT+], 出错 AUTH, N(error), [V+][N+]

C.3. 含 EAP 的 IKE_AUTH 交换

first request --> IDi, [N(INITIAL_CONTACT)], [[N(HTTP_CERT_LOOKUP_SUPPORTED)], CERTREQ+], [IDr], [CP(CFG_REQUEST)], [N(IPCOMP_SUPPORTED)+], [N(USE_TRANSPORT_MODE)], [N(ESP_TFC_PADDING_NOT_SUPPORTED)], [N(NON_FIRST_FRAGMENTS_ALSO)], SA, TSi, TSr, [V+][N+]

first response <-- IDr, [CERT+], AUTH, EAP, [V+][N+]

              / --> EAP

重复 1..N 次 | \ <-- EAP

last request --> AUTH

last response <-- AUTH, [CP(CFG_REPLY)], [N(IPCOMP_SUPPORTED)], [N(USE_TRANSPORT_MODE)], [N(ESP_TFC_PADDING_NOT_SUPPORTED)], [N(NON_FIRST_FRAGMENTS_ALSO)], SA, TSi, TSr, [N(ADDITIONAL_TS_POSSIBLE)], [V+][N+]

C.4. 用于创建或重密钥化子 SA 的 CREATE_CHILD_SA 交换

request --> [N(REKEY_SA)], [CP(CFG_REQUEST)], [N(IPCOMP_SUPPORTED)+], [N(USE_TRANSPORT_MODE)], [N(ESP_TFC_PADDING_NOT_SUPPORTED)], [N(NON_FIRST_FRAGMENTS_ALSO)], SA, Ni, [KEi], TSi, TSr [V+][N+]

normal <-- [CP(CFG_REPLY)], response [N(IPCOMP_SUPPORTED)], [N(USE_TRANSPORT_MODE)], [N(ESP_TFC_PADDING_NOT_SUPPORTED)], [N(NON_FIRST_FRAGMENTS_ALSO)], SA, Nr, [KEr], TSi, TSr, [N(ADDITIONAL_TS_POSSIBLE)] [V+][N+]

error case <-- N(error)

不同的 Diffie- <-- N(INVALID_KE_PAYLOAD), Hellman 群 [V+][N+] 不一致

C.5. 用于重密钥化 IKE SA 的 CREATE_CHILD_SA 交换

request --> SA, Ni, KEi [V+][N+]

response <-- SA, Nr, KEr [V+][N+]

C.6. INFORMATIONAL 交换

request --> [N+], [D+], [CP(CFG_REQUEST)]

response <-- [N+], [D+], [CP(CFG_REPLY)]

作者地址

Charlie Kaufman Microsoft 1 Microsoft Way Redmond, WA 98052 US

Phone: 1-425-707-3335 EMail: [email protected]

Paul Hoffman VPN Consortium 127 Segre Place Santa Cruz, CA 95060 US

Phone: 1-831-426-9827 EMail: [email protected]

Yoav Nir Check Point Software Technologies Ltd. 5 Hasolelim St. Tel Aviv 67897 Israel

EMail: [email protected]

Pasi Eronen Independent

EMail: [email protected]