Title

  Test IKEv2.EN.I.1.2.5.1: Create new CHILD_SA by sending CREATE_CHILD_SA request
  Part A: (ADVANCED)

Purpose

  To verify an IKEv2 device properly handles the CREATE_CHILD_SA Exchanges to
  generate new CHILD_SAs.

References

  * [RFC 4306] - Sections 1.1.2,1.2 and 3.3.2
  * [RFC 4307] - Sections 3
  * [RFC 4718] - Sections 4.1

Test Setup

  * Network Topology
      Connect the devices according to the Common Topology.
  * Configuration
      In each part, configure the devices according to the Common Configuration.
  * Pre-Sequence and Cleanup Sequence
      IKEv2 on the NUT is disabled after each part.

Procedure

   NUT                  TN1
(End-Node)           (End-Node)
    |                    |
    |------------------->| IKE_SA_INIT request (HDR, SAi1, KEi, Ni)
    |                    | (Judgement #1)
    |<-------------------| IKE_SA_INIT Response (HDR, SAr1, KEr, Nr)
    |                    | (Packet #1)
    |                    | 
    |------------------->| IKE_AUTH request (HDR, SK {IDi, AUTH, N, SAi2, TSi, TSr})
    |                    | (Judgement #2)
    |<-------------------| IKE_AUTH Response (HDR, SK {IDr, AUTH, N, SAr2, TSi, TSr})
    |                    | (Packet #2)
    |                    |
    |------------------->| CREATE_CHILD_SA request (HDR, SK {N, SA, Ni, TSi, TSr})
    |                    | (Judgement #3)
    |                    |
    V                    V


 N: USE_TRANSPORT_MODE

Packet #1	See below
Packet #2	See Common Packet #4

Packet #2: IKE_AUTH response

IPv6 Header	Same as the Common Packet #4
UDP Header	Same as the Common Packet #4
IKEv2 Header	Same as the Common Packet #4
E Payload	Same as the Common Packet #4
IDi Payload	Same as the Common Packet #4
AUTH Payload	Same as the Common Packet #4
N Payload	Same as the Common Packet #4
SA Payload	Same as the Common Packet #4
TSi Payload	Other fields are same as the Common Packet #4
	Traffic Selectors	See below
TSr Payload	Other fields are same as the Common Packet #4
	Traffic Selectors	See below

TSi Payload	Traffic Selector	TS Type	8 (IPV6_ADDR_RANGE)
		IP Protocol ID	6 (TCP)
		Selector Length	40
		Start Port	0
		End Port	65535
		Starting Address	NUT's Global Address on Link A
		Ending Address	NUT's Global Address on Link A

TSr Payload	Traffic Selector	TS Type	8 (IPV6_ADDR_RANGE)
		IP Protocol ID	6 (TCP)
		Selector Length	40
		Start Port	0
		End Port	65535
		Starting Address	TN1's Global Address on Link X
		Ending Address	TN1's Global Address on Link X

  Part A: (ADVANCED)
       1. NUT starts to negotiate with TN1 by sending IKE_SA_INIT request.
       2. Observe the messages transmitted on Link A.
       3. TN1 responds with an IKE_SA_INIT response to the NUT.
       4. Observe the messages transmitted on Link A.
       5. After reception of IKE_AUTH request from the NUT, TN1 responds with an IKE_AUTH
          response to the NUT
       6. NUT starts to negotiate new CHILD_SA with TN1 by sending CREATE_CHILD_SA
          request.
       7. Observe the messages transmitted on Link A.

Observable Result

  Part A
    Step 2: Judgment #1
      The NUT transmits an IKE_SA_INIT request including "ENCR_3DES",
      "PRF_HMAC_SHA1", "AUTH_HMAC_SHA1_96" and "D-H group 2" as proposed
      algorithms.
  
    Step 4: Judgment #2
      The NUT transmits an IKE_AUTH request including "ENCR_3DES",
      "AUTH_HMAC_SHA1_96" and "No Extended Sequence Numbers" as proposed algorithms.
  
    Step 7: Judgment #3
      The NUT transmits a CREATE_CHILD_SA request including "ENCR_3DES",
      "AUTH_HMAC_SHA1_96" and "No Extended Sequence Numbers" as proposed algorithms.

Possible Problems

  * None.