Why is there two traffic selectors on an IKEv2 tunnel with only one network configured?Last modified on 7 Feb, 2022. Revision 6
|Up to date for||
When i look at the ikesnoop for my IKEv2 tunnel establishment, why is there two traffic selectors for the initiator and terminator in phase-2? I have only configured one network.
The reason for that is because IKEv2 also contains information about exactly which two IP addresses and ports/protocol that was used to initiate the tunnel. This is an example on how it can look in IKEv2:
Initiator<pre style="color: white;background: black;"> TSi (Traffic Selector - Initiator) Traffic selector 1/2 IP protocol : 1 Port range : 2048-2048 Address range: 192.168.3.1-192.168.3.1 Traffic selector 2/2 IP protocol : 0 Port range : 0-0 Address range: 192.168.3.0-192.168.3.255 </pre>Responder<pre style="color: white;background: black;"> TSr (Traffic Selector - Responder) Traffic selector 1/2 IP protocol : 1 Port range : 2048-2048 Address range: 192.168.1.153-192.168.1.153 Traffic selector 2/2 IP protocol : 0 Port range : 0-0 Address range: 192.168.1.0-192.168.1.255</pre>If we first look at the Initiator we see that it first sends a single port range (2048-2048) and the address range 192.168.3.1-192.168.3.1. What this means is that this is a description of whom it was that initiated the tunnel, it was this particular IP that tried to reach something beyond the IPsec tunnel that triggered the start of the tunnel negotiation.
The port range may look a bit strange, but in this case the IP protocol is 1, which means ICMP/ping. Since ICMP does not have a port and a port is required for a traffic selector it is the decimal value of ICMP type 8 (echo request) and code 00 (a request never has any codes). Combined it will be a hex value of 800 which if you convert this to decimal it becomes 2048.
And if we look at the Responder we will have a similar port range there and the address range is once again a single IP, this then is the IP address that the Initiator was trying to reach.
The conclusion is that the tunnel was initiated because source IP 192.168.3.1 sent an ICMP echo request to 192.168.1.153. The tunnel (if it succeeds) will be established to allow networks 192.168.1.0/24 and 192.168.3.0/24 to communicate with each other.
More information about the various ICMP codes can be found here : https://en.wikipedia.org/wiki/Internet_ … e_Protocol
5 Apr, 2022 core certificate oneconnect ipsec vpn
22 Mar, 2021 core ipsec routing
17 Jun, 2021 core ipsec routing
14 Apr, 2021 core license ipsec
8 Sep, 2020 core ipsec rules access
16 Sep, 2020 vpn ipsec ikev2 windows howto dh
30 Nov, 2020 core ipsec license memory
18 Feb, 2021 core connections ipsec memory