RFC 7651
3GPP IP Multimedia Subsystems (IMS) Option for the Internet Key Exchange Protocol Version 2 (IKEv2)
3GPP IP Multimedia Subsystems (IMS) Option for the Internet Key Exchange Protocol Version 2 (IKEv2) 🎀
RFC 7651 is an Independent Submission, so it came in from outside the main IETF stream 🦋 It's marked Informational, which means it's sharing info and is not a Standards Track spec 💅 It was published in September 2015 with ISSN 2070-1721. The authors are A. Dodd-Noble, S. Gundavelli (Cisco), J. Korhonen and F. Baboescu (Broadcom Corporation), and B. Weis (Cisco) 👑 The title block doesn't list any RFC that this one obsoletes or updates 🌸
Abstract ✨
okay so this doc defines two new configuration attributes for IKEv2 🔐 They carry the IPv4 address and the IPv6 address of the Proxy-Call Session Control Function (P-CSCF). When an IPsec gateway hands these to an IPsec client, the client can find out the IPv4 and/or IPv6 address of the P-CSCF server sitting in the 3GPP network 💖
Status of This Memo 📋
bestie, this one is not an Internet Standards Track spec. It's published just for information 🌈
It's a contribution to the RFC Series, separate from any other RFC stream. The RFC Editor chose to publish it at their discretion, and they make zero statement about whether it's valuable for implementation or deployment 🫶 Documents approved for publication by the RFC Editor are not a candidate for any level of Internet Standard. See Section 2 of RFC 5741 for the details 📖
For the current status, any errata, and how to give feedback, check http://www.rfc-editor.org/info/rfc7651 ✨
Copyright Notice 🌸
Copyright (c) 2015 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stood on the publication date. Read those carefully, because they spell out your rights and restrictions for this document 🦋
Table of Contents 🗂️
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Conventions and Terminology . . . . . . . . . . . . . . . . . 4
2.1. Conventions . . . . . . . . . . . . . . . . . . . . . . . 4
2.2. Terminology . . . . . . . . . . . . . . . . . . . . . . . 4
3. P_CSCF_IP4_ADDRESS Configuration Attribute . . . . . . . . . 4
4. P_CSCF_IP6_ADDRESS Configuration Attribute . . . . . . . . . 5
5. Example Scenario . . . . . . . . . . . . . . . . . . . . . . 7
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7
7. Security Considerations . . . . . . . . . . . . . . . . . . . 8
8. References . . . . . . . . . . . . . . . . . . . . . . . . . 8
8.1. Normative References . . . . . . . . . . . . . . . . . . 8
8.2. Informative References . . . . . . . . . . . . . . . . . 8
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 9
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 101. Introduction ✨
So the 3GPP S2b reference point [TS23402] is specified by the 3GPP system architecture, and it's a mechanism for letting a mobile node (MN) connected to an untrusted, non-3GPP IP access network securely connect to a 3GPP network and access IP services 🧚 The mobile node sets up an IPsec Encapsulating Security Payload (ESP) tunnel [RFC4303] to a security gateway called the Evolved Packet Data Gateway (ePDG). The ePDG then sets up a Proxy Mobile IPv6 (PMIPv6) [RFC5213] or GPRS Tunneling Protocol (GTP) [TS23402] tunnel to the Packet Data Network Gateway (PGW) [TS23402], which is where the mobile node's session is anchored 💜
Here's the interworking option for non-3GPP access over an untrusted access network 👀 The Mobile Access Gateway (MAG) and Local Mobility Anchor (LMA) functions are defined in [RFC5213]. The ePDG and PGW functions are defined in [TS23402]. The IPsec ESP tunnel runs between the MN and the ePDG, and either a PMIP or GTP tunnel runs between the ePDG and PGW 🔥
+------------+
| ePDG |
| +--------+ |
+------+ _----_ | | IPsec | | _----_ +-----+
| MN | _( )_ | | Module | | _( )_ | LMA |
| |<====( Internet )=====| +--------+ |===( Operator )===|(PGW)|
+------+ (_ _) | : | (_Network_) +-----+
'----' | +--------+ | '----'
IPsec Tunnel | | PMIPv6 | | PMIPv6/GTP Tunnel
| | MAG | |
| +--------+ |
+------------+
|<------------ IKEv2/IPsec ------> | <------ PMIPv6/GTP ----->|Figure 1: Exchange of IPv4 Traffic Offload Selectors
A mobile node in this setup may potentially need to reach IP Multimedia Subsystem (IMS) services in the 3GPP network 📱 The 3GPP IMS architecture is described in [TS23228] and [TS24229]. Right now there are no attributes in IKEv2 [RFC7296] that can carry these information elements 😭 Without them, the mobile node has to be statically configured with this info, and honestly that's proving to be an operational challenge 💀 Other ways of discovering these functions, like using DNS or DHCP, would end up pulling config from the access network and not the home network 🙈 The 3GPP interface is mainly for letting the mobile node connect to a 3GPP network through an untrusted access network. So the access network may not have any relation with the home network provider, and it may be unable to deliver the mobile node's home network configuration 🥺
This specification therefore defines two new IKEv2 attributes [RFC7296] that let an IPsec gateway provide the IPv4 and/or IPv6 address of the P-CSCF server 🎀 These attributes can be exchanged by IKEv2 peers as part of the configuration payload exchange. They follow the configuration attribute format defined in Section 3.15.1 of [RFC7296]. Plus, putting the P-CSCF server address(es) in IKEv2 as standard attribute(s) means clients can directly access IMS services behind a VPN gateway without going through the 3GPP-specific interfaces 🦋
2. Conventions and Terminology 🌸
2.1. Conventions
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119]. 🤓
2.2. Terminology
All the IKEv2-related terms used here are to be interpreted as defined in [RFC7296] and [RFC5739]. All the mobility-related terms are to be interpreted as defined in [RFC5213] and [RFC5844]. This doc also uses the following terms 💅
- Proxy-Call Session Control Function (P-CSCF): The P-CSCF is the entry point to the 3GPP IMS and acts as the SIP outbound proxy for the mobile node. The mobile node does SIP registration to 3GPP IMS and starts SIP sessions via a P-CSCF 📞
- Evolved Packet Data Gateway (ePDG): This is a security gateway defined by the 3GPP system architecture. The protocol interfaces it supports include IKEv2 [RFC7296] 🔐
3. P_CSCF_IP4_ADDRESS Configuration Attribute 💖
The P_CSCF_IP4_ADDRESS configuration attribute is formatted like this 👇
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|R| Attribute Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IPv4 Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 2: IPv4 Address of P-CSCF
Here's what each field means 🧩
Reserved (1 bit): Refer to the IKEv2 specification [RFC7296]Attribute Type (15 bits): 20Length (2 octets): Length of the IPv4 address field that follows. Possible values are (0) and (4). A value of (4) indicates the size of the 4-octet IPv4 address that follows. A value of (0) indicates that it's an empty attribute with a zero-length IPv4 address field, primarily used as a request indicator.IPv4 Address (4 octets): An IPv4 address of the P-CSCF server.
The P_CSCF_IP4_ADDRESS configuration attribute provides an IPv4 address of a P-CSCF server within the network. If an instance of an empty P_CSCF_IP4_ADDRESS attribute with a zero-length IPv4 Address field is included by the mobile node, the responder MAY respond with zero, one, or more P_CSCF_IP4_ADDRESS attributes. If several P_CSCF_IP4_ADDRESS attributes are provided in one IKEv2 message, there is no implied order among them. However, a system architecture using this specification may be able to enforce some order at both the peers ✨
4. P_CSCF_IP6_ADDRESS Configuration Attribute 🦋
The P_CSCF_IP6_ADDRESS configuration attribute is formatted like this 👇
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|R| Attribute Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
| |
| IPv6 Address |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 3: IPv6 Address of P-CSCF
Here's what each field means 🧩
Reserved (1 bit): Refer to the IKEv2 specification [RFC7296]Attribute Type (15 bits): 21Length (2 octets): Length of the IPv6 address field that follows. Possible values are (0) and (16). A value of (16) indicates the size of the 16-octet IPv6 address that follows. A value of (0) indicates that it's an empty attribute with a zero-length IPv6 address field, primarily used as a request indicator.IPv6 Address (16 octets): An IPv6 address of the P-CSCF server.
The P_CSCF_IP6_ADDRESS configuration attribute provides an IPv6 address of a P-CSCF server within the network. If an instance of an empty P_CSCF_IP6_ADDRESS attribute with a zero-length IPv6 Address field is included by the mobile node, the responder MAY respond with zero, one, or more P_CSCF_IP6_ADDRESS attributes. If several P_CSCF_IP6_ADDRESS attributes are provided in one IKEv2 message, there is no implied order among them. However, a system architecture using this specification may be able to enforce some order at both the peers 💜
5. Example Scenario ✨
okay so bestie, the mobile node MAY request the IP address of a P-CSCF server, and here's what that looks like on the wire 🦋 (the client on the left, the gateway on the right, and it's giving very organized energy):
Client Gateway
-------- ---------
HDR(IKE_SA_INIT), SAi1, KEi, Ni -->
<-- HDR(IKE_SA_INIT), SAr1, KEr, Nr, [CERTREQ]
HDR(IKE_AUTH),
SK { IDi, CERT, [CERTREQ], AUTH, [IDr],
CP(CFG_REQUEST) =
{ INTERNAL_IP4_ADDRESS(),
INTERNAL_IP4_DNS(),
P_CSCF_IP4_ADDRESS() }, SAi2,
TSi = (0, 0-65535, 0.0.0.0-255.255.255.255),
TSr = (0, 0-65535, 0.0.0.0-255.255.255.255) } -->
<-- HDR(IKE_AUTH),
SK { IDr, CERT, AUTH,
CP(CFG_REPLY) =
{ INTERNAL_IP4_ADDRESS(192.0.2.234),
P_CSCF_IP4_ADDRESS(192.0.2.1),
P_CSCF_IP4_ADDRESS(192.0.2.4),
INTERNAL_IP4_DNS(198.51.100.33) },
SAr2,
TSi = (0, 0-65535, 192.0.2.234-192.0.2.234),
TSr = (0, 0-65535, 0.0.0.0-255.255.255.255) }
Figure 4: P-CSCF Attribute Exchange6. IANA Considerations 🎀
okay so per this document, the following IANA actions have been completed, and they are literally the main event 👑
- Action 1: this spec defines a new IKEv2 attribute for carrying the IPv4 address of the P-CSCF server 💖 It's defined in Section 3, and it's been assigned value 20 from the "IKEv2 Configuration Payload Attribute Types" namespace defined in [RFC7296].
- Action 2: this spec defines a new IKEv2 attribute for carrying the IPv6 address of the P-CSCF server 🧚 It's defined in Section 4, and it's been assigned value 21 from the "IKEv2 Configuration Payload Attribute Types" namespace defined in [RFC7296].
7. Security Considerations 💀
okay this part is SO important, so pay attention bestie 😭 This document is an extension to IKEv2 [RFC7296], and therefore it inherits ALL the security properties of IKEv2. No cap, that's the whole foundation.
The two new IKEv2 attributes defined in this specification are for carrying the IPv4 and IPv6 address of the P-CSCF server. These attributes can be exchanged by IKE peers as part of the configuration payload, and the currently defined IKEv2 security framework provides the needed integrity and privacy protection for them. Therefore, this specification does not introduce any new security vulnerabilities. Periodt 🔒✨
8. References 📚
8.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<http://www.rfc-editor.org/info/rfc2119>.
[RFC4303] Kent, S., "IP Encapsulating Security Payload (ESP)",
RFC 4303, DOI 10.17487/RFC4303, December 2005,
<http://www.rfc-editor.org/info/rfc4303>.
[RFC7296] Kaufman, C., Hoffman, P., Nir, Y., Eronen, P., and T.
Kivinen, "Internet Key Exchange Protocol Version 2
(IKEv2)", STD 79, RFC 7296, DOI 10.17487/RFC7296, October
2014, <http://www.rfc-editor.org/info/rfc7296>.8.2. Informative References
[RFC5213] Gundavelli, S., Ed., Leung, K., Devarapalli, V.,
Chowdhury, K., and B. Patil, "Proxy Mobile IPv6",
RFC 5213, DOI 10.17487/RFC5213, August 2008,
<http://www.rfc-editor.org/info/rfc5213>.
[RFC5739] Eronen, P., Laganier, J., and C. Madson, "IPv6
Configuration in Internet Key Exchange Protocol Version 2
(IKEv2)", RFC 5739, DOI 10.17487/RFC5739, February 2010,
<http://www.rfc-editor.org/info/rfc5739>.
[RFC5844] Wakikawa, R. and S. Gundavelli, "IPv4 Support for Proxy
Mobile IPv6", RFC 5844, DOI 10.17487/RFC5844, May 2010,
<http://www.rfc-editor.org/info/rfc5844>.
[TS23228] 3GPP, "IP Multimedia Subsystem (IMS); Stage 2", 3GPP TS
23.228, Version 13.3.0, June 2015.
[TS23402] 3GPP, "Architecture enhancements for non-3GPP accesses",
3GPP TS 23.402, Version 13.2.0, June 2015.
[TS24229] 3GPP, "IP multimedia call control protocol based on
Session Initiation Protocol (SIP) and Session Description
Protocol (SDP); Stage 3", 3GPP TS 24.229, Version 13.2.1,
June 2015.Acknowledgements 🫶
the authors want to specially thank Tero Kivinen for the detailed reviews 🙌 They'd also like to thank Vojislav Vucetic, Heather Sze, Sebastian Speicher, Maulik Vaidya, Ivo Sedlacek, Pierrick Siete, and Hui Deng for all the discussions related to this topic. Iconic group, honestly 💜
Authors' Addresses 🌸
Aeneas Noble
Cisco
30 International Pl
Tewksbury, MA 95134
United States
Email: noblea@cisco.com
Sri Gundavelli
Cisco
170 West Tasman Drive
San Jose, CA 95134
United States
Email: sgundave@cisco.com
Jouni Korhonen
Broadcom Corporation
3151 Zanker Road
San Jose, CA 95134
United States
Email: jouni.nospam@gmail.com
Florin Baboescu
Broadcom Corporation
100 Mathilda Place
Sunnyvale, CA 94086
United States
Email: baboescu@broadcom.com
Brian Weis
Cisco
170 West Tasman Drive
San Jose, CA 95134
United States
Email: bew@cisco.com📦 where this page comes from
- ietf: rfc7651 2015-09
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms