Request for Comments: 3948 F-Secure Corporation
Category: Standards Track B. Swander
Microsoft
V. Volpe
Cisco Systems
L. DiBurro
Nortel Networks
M. Stenberg
January 2005
UDP Encapsulation of IPsec ESP Packets
Status of this Memo
This document specifies an Internet standards track protocol for the
Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (2005).
Abstract
This protocol specification defines methods to encapsulate and
decapsulate IP Encapsulating Security Payload (ESP) packets inside
UDP packets for traversing Network Address Translators. ESP
encapsulation, as defined in this document, can be used in both IPv4
and IPv6 scenarios. Whenever negotiated, encapsulation is used with
Internet Key Exchange (IKE).
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Packet Formats . . . . . . . . . . . . . . . . . . . . . . . . 3
2.1. UDP-Encapsulated ESP Header Format . . . . . . . . . . . 3
2.2. IKE Header Format for Port 4500 . . . . . . . . . . . . 4
2.3. NAT-Keepalive Packet Format . . . . . . . . . . . . . . 4
3. Encapsulation and Decapsulation Procedures . . . . . . . . . . 5
3.1. Auxiliary Procedures . . . . . . . . . . . . . . . . . . 5
3.1.1. Tunnel Mode Decapsulation NAT Procedure . . . . 5
3.1.2. Transport Mode Decapsulation NAT Procedure . . . 5
3.2. Transport Mode ESP Encapsulation . . . . . . . . . . . . 6
3.3. Transport Mode ESP Decapsulation . . . . . . . . . . . . 6
3.4. Tunnel Mode ESP Encapsulation . . . . . . . . . . . . . 7
3.5. Tunnel Mode ESP Decapsulation . . . . . . . . . . . . . 7
4. NAT Keepalive Procedure . . . . . . . . . . . . . . . . . . . 7
5. Security Considerations . . . . . . . . . . . . . . . . . . . 8
5.1. Tunnel Mode Conflict . . . . . . . . . . . . . . . . . . 8
5.2. Transport Mode Conflict . . . . . . . . . . . . . . . . 9
6. IAB Considerations . . . . . . . . . . . . . . . . . . . . . . 10
7. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 11
8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 11
8.1. Normative References . . . . . . . . . . . . . . . . . . 11
8.2. Informative References . . . . . . . . . . . . . . . . . 11
A. Clarification of Potential NAT Multiple Client Solutions . . . 12
Authors’ Addresses . . . . . . . . . . . . . . . . . . . . . . 14
Full Copyright Statement . . . . . . . . . . . . . . . . . . . 15
1. Introduction
This protocol specification defines methods to encapsulate and
decapsulate ESP packets inside UDP packets for traversing Network
Address Translators (NATs) (see [RFC3715], section 2.2, case i). The
UDP port numbers are the same as those used by IKE traffic, as
defined in [RFC3947].
The sharing of the port numbers for both IKE and UDP encapsulated ESP
traffic was selected because it offers better scaling (only one NAT
mapping in the NAT; no need to send separate IKE keepalives), easier
configuration (only one port to be configured in firewalls), and
easier implementation.
A client’s needs should determine whether transport mode or tunnel
mode is to be supported (see [RFC3715], Section 3, "Telecommuter
scenario"). L2TP/IPsec clients MUST support the modes as defined in
[RFC3193]. IPsec tunnel mode clients MUST support tunnel mode.
An IKE implementation supporting this protocol specification MUST NOT
use the ESP SPI field zero for ESP packets. This ensures that IKE
packets and ESP packets can be distinguished from each other.
As defined in this document, UDP encapsulation of ESP packets is
written in terms of IPv4 headers. There is no technical reason why
an IPv6 header could not be used as the outer header and/or as the
inner header.
Because the protection of the outer IP addresses in IPsec AH is
inherently incompatible with NAT, the IPsec AH was left out of the
scope of this protocol specification. This protocol also assumes
that IKE (IKEv1 [RFC2401] or IKEv2 [IKEv2]) is used to negotiate the
IPsec SAs. Manual keying is not supported.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119].
2. Packet Formats
2.1. UDP-Encapsulated ESP Header Format
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Port | Destination Port |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Length | Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ESP header [RFC2406] |
~ ~
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The UDP header is a standard [RFC0768] header, where
o the Source Port and Destination Port MUST be the same as that used
by IKE traffic,
o the IPv4 UDP Checksum SHOULD be transmitted as a zero value, and
o receivers MUST NOT depend on the UDP checksum being a zero value.
The SPI field in the ESP header MUST NOT be a zero value.
2.2. IKE Header Format for Port 4500
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Port | Destination Port |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Length | Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Non-ESP Marker |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IKE header [RFC2409] |
~ ~
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The UDP header is a standard [RFC0768] header and is used as defined
in [RFC3947]. This document does not set any new requirements for
the checksum handling of an IKE packet.
A Non-ESP Marker is 4 zero-valued bytes aligning with the SPI field
of an ESP packet.
2.3. NAT-Keepalive Packet Format
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Port | Destination Port |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Length | Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 0xFF |
+-+-+-+-+-+-+-+-+
The UDP header is a standard [RFC0768] header, where
o the Source Port and Destination Port MUST be the same as used by
UDP-ESP encapsulation of Section 2.1,
o the IPv4 UDP Checksum SHOULD be transmitted as a zero value, and
o receivers MUST NOT depend upon the UDP checksum being a zero
value.
The sender MUST use a one-octet-long payload with the value 0xFF.
The receiver SHOULD ignore a received NAT-keepalive packet.
3. Encapsulation and Decapsulation Procedures
3.1. Auxiliary Procedures
3.1.1. Tunnel Mode Decapsulation NAT Procedure
When a tunnel mode has been used to transmit packets (see [RFC3715],
section 3, criteria "Mode support" and "Telecommuter scenario"), the
inner IP header can contain addresses that are not suitable for the
current network. This procedure defines how these addresses are to
be converted to suitable addresses for the current network.
Depending on local policy, one of the following MUST be done:
1. If a valid source IP address space has been defined in the policy
for the encapsulated packets from the peer, check that the source
IP address of the inner packet is valid according to the policy.
2. If an address has been assigned for the remote peer, check that
the source IP address used in the inner packet is the assigned IP
address.
3. NAT is performed for the packet, making it suitable for transport
in the local network.
3.1.2. Transport Mode Decapsulation NAT Procedure
When a transport mode has been used to transmit packets, contained
TCP or UDP headers will have incorrect checksums due to the change of
parts of the IP header during transit. This procedure defines how to
fix these checksums (see [RFC3715], section 2.1, case b).
Depending on local policy, one of the following MUST be done:
1. If the protocol header after the ESP header is a TCP/UDP header
and the peer’s real source and destination IP address have been
received according to [RFC3947], incrementally recompute the
TCP/UDP checksum:
* Subtract the IP source address in the received packet from the
checksum.
* Add the real IP source address received via IKE to the
checksum (obtained from the NAT-OA)
* Subtract the IP destination address in the received packet
from the checksum.
* Add the real IP destination address received via IKE to the
checksum (obtained from the NAT-OA).
Note: If the received and real address are the same for a given
address (e.g., say the source address), the operations cancel and
don’t need to be performed.
2. If the protocol header after the ESP header is a TCP/UDP header,
recompute the checksum field in the TCP/UDP header.
3. If the protocol header after the ESP header is a UDP header, set
the checksum field to zero in the UDP header. If the protocol
after the ESP header is a TCP header, and if there is an option
to flag to the stack that the TCP checksum does not need to be
computed, then that flag MAY be used. This SHOULD only be done
for transport mode, and if the packet is integrity protected.
Tunnel mode TCP checksums MUST be verified. (This is not a
violation to the spirit of section 4.2.2.7 in [RFC1122] because a
checksum is being generated by the sender and verified by the
receiver. That checksum is the integrity over the packet
performed by IPsec.)
In addition an implementation MAY fix any contained protocols that
have been broken by NAT (see [RFC3715], section 2.1, case g).
3.2. Transport Mode ESP Encapsulation
BEFORE APPLYING ESP/UDP
----------------------------
IPv4 |orig IP hdr | | |
|(any options)| TCP | Data |
----------------------------
AFTER APPLYING ESP/UDP
-------------------------------------------------------
IPv4 |orig IP hdr | UDP | ESP | | | ESP | ESP|
|(any options)| Hdr | Hdr | TCP | Data | Trailer |Auth|
-------------------------------------------------------
|<----- encrypted ---->|
|<------ authenticated ----->|
1. Ordinary ESP encapsulation procedure is used.
2. A properly formatted UDP header is inserted where shown.
3. The Total Length, Protocol, and Header Checksum (for IPv4) fields
in the IP header are edited to match the resulting IP packet.
3.3. Transport Mode ESP Decapsulation
1. The UDP header is removed from the packet.
2. The Total Length, Protocol, and Header Checksum (for IPv4) fields
in the new IP header are edited to match the resulting IP packet.
3. Ordinary ESP decapsulation procedure is used.
4. Transport mode decapsulation NAT procedure is used.
3.4. Tunnel Mode ESP Encapsulation
BEFORE APPLYING ESP/UDP
----------------------------
IPv4 |orig IP hdr | | |
|(any options)| TCP | Data |
----------------------------
AFTER APPLYING ESP/UDP
--------------------------------------------------------------
IPv4 |new h.| UDP | ESP |orig IP hdr | | | ESP | ESP|
|(opts)| Hdr | Hdr |(any options)| TCP | Data | Trailer |Auth|
--------------------------------------------------------------
|<------------ encrypted ----------->|
|<------------- authenticated ------------>|
1. Ordinary ESP encapsulation procedure is used.
2. A properly formatted UDP header is inserted where shown.
3. The Total Length, Protocol, and Header Checksum (for IPv4) fields
in the new IP header are edited to match the resulting IP packet.
3.5. Tunnel Mode ESP Decapsulation
1. The UDP header is removed from the packet.
2. The Total Length, Protocol, and Header Checksum (for IPv4) fields
in the new IP header are edited to match the resulting IP packet.
3. Ordinary ESP decapsulation procedure is used.
4. Tunnel mode decapsulation NAT procedure is used.
4. NAT Keepalive Procedure
The sole purpose of sending NAT-keepalive packets is to keep NAT
mappings alive for the duration of a connection between the peers
(see [RFC3715], Section 2.2, case j). Reception of NAT-keepalive
packets MUST NOT be used to detect whether a connection is live.
A peer MAY send a NAT-keepalive packet if one or more phase I or
phase II SAs exist between the peers, or if such an SA has existed at
most N minutes earlier. N is a locally configurable parameter with a
default value of 5 minutes.
A peer SHOULD send a NAT-keepalive packet if a need for it is
detected according to [RFC3947] and if no other packet to the peer
has been sent in M seconds. M is a locally configurable parameter
with a default value of 20 seconds.
5. Security Considerations
5.1. Tunnel Mode Conflict
Implementors are warned that it is possible for remote peers to
negotiate entries that overlap in an SGW (security gateway), an issue
affecting tunnel mode (see [RFC3715], section 2.1, case e).
+----+ \ /
| |-------------|----\
+----+ / \ \
Ari’s NAT 1 \
Laptop \
10.1.2.3 \
+----+ \ / \ +----+ +----+
| |-------------|----------+------| |----------| |
+----+ / \ +----+ +----+
Bob’s NAT 2 SGW Suzy’s
Laptop Server
10.1.2.3
Because SGW will now see two possible SAs that lead to 10.1.2.3, it
can become confused about where to send packets coming from Suzy’s
server. Implementors MUST devise ways of preventing this from
occurring.
It is RECOMMENDED that SGW either assign locally unique IP addresses
to Ari’s and Bob’s laptop (by using a protocol such as DHCP over
IPsec) or use NAT to change Ari’s and Bob’s laptop source IP
addresses to these locally unique addresses before sending packets
forward to Suzy’s server. This covers the "Scaling" criteria of
section 3 in [RFC3715].
Please see Appendix A.
5.2. Transport Mode Conflict
Another similar issue may occur in transport mode, with 2 clients,
Ari and Bob, behind the same NAT talking securely to the same server
(see [RFC3715], Section 2.1, case e).
Cliff wants to talk in the clear to the same server.
+----+
| |
+----+ \
Ari’s \
Laptop \
10.1.2.3 \
+----+ \ / +----+
| |-----+-----------------| |
+----+ / \ +----+
Bob’s NAT Server
Laptop /
10.1.2.4 /
/
+----+ /
| |/
+----+
Cliff’s
Laptop
10.1.2.5
Now, transport SAs on the server will look like this:
To Ari: Server to NAT, <traffic desc1>, UDP encap <4500, Y>
To Bob: Server to NAT, <traffic desc2>, UDP encap <4500, Z>
Cliff’s traffic is in the clear, so there is no SA.
<traffic desc> is the protocol and port information. The UDP encap
ports are the ports used in UDP-encapsulated ESP format of section
2.1. Y,Z are the dynamic ports assigned by the NAT during the IKE
negotiation. So IKE traffic from Ari’s laptop goes out on UDP
<4500,4500>. It reaches the server as UDP <Y,4500>, where Y is the
dynamically assigned port.
If the <traffic desc1> overlaps <traffic desc2>, then simple filter
lookups may not be sufficient to determine which SA has to be used to
send traffic. Implementations MUST handle this situation, either by
disallowing conflicting connections, or by other means.
Assume now that Cliff wants to connect to the server in the clear.
This is going to be difficult to configure, as the server already has
a policy (from Server to the NAT’s external address) for securing
<traffic desc>. For totally non-overlapping traffic descriptions,
this is possible.
Sample server policy could be as follows:
To Ari: Server to NAT, All UDP, secure
To Bob: Server to NAT, All TCP, secure