Test IKEv2.EN.I.1.3.3.1: Non zero RESERVED fields in INFORMATIONAL response Part A: (BASIC)
To verify an IKEv2 device ignores the content of RESERVED filed in IKE messages.
* [RFC 4306] - Sections 2.5
* Network Topology Connect the devices according to the Common Topology. * Configuration In each part, configure the devices according to the Common Configuration. In addition, set IKE_SA Lifetime and CHILD_SA Lifetime to more than twice as INFORMATIONAL message retransmission timer as. * Pre-Sequence and Cleanup Sequence IKEv2 on the NUT is disabled after each part.
NUT TN1 (End-Node) (End-Node) | | |------------------->| IKE_SA_INIT request (HDR, SAi1, KEi, Ni) | | (Judgement #1) |<-------------------| IKE_SA_INIT Response (HDR, SAr1, KEr, Nr) | | (Packet #1) | | |------------------->| IKE_AUTH request (HDR, SK {IDi, AUTH, N, SAi2, TSi, TSr}) | | (Judgement #2) |<-------------------| IKE_AUTH Response (HDR, SK {IDr, AUTH, N, SAr2, TSi, TSr}) | | (Packet #2) | | | * wait until receiving liveness check | | |------------------->| INFORMATIONAL request (HDR, SK {}) | | (Judgement #3) |<-------------------| INFORMATIONAL response (HDR, SK {}) | | (Packet #3) | | |--------X | INFORMATIONAL request (HDR, SK {}) | | (Judgement #3) | | V V
N: USE_TRANSPORT_MODE
Packet #1 See Common Packet #2 Packet #2 See Common Packet #4 Packet #3 See Common Packet #18i
All RESERVED fields are set to one.
Part A: (BASIC) 1. NUT starts to negotiate with TN1 by sending IKE_SA_INIT request. 2. Observe the messages transmitted on Link A. 3. TN1 responds with an IKE_SA_INIT response to the NUT. 4. Observe the messages transmitted on Link A. 5. After reception of IKE_AUTH request from the NUT, TN1 responds with an IKE_AUTH response to the NUT. 6. TN1 waits for receiving an INFORMATIONAL request with no payloads. 7. Observe the messages transmitted on Link A. 8. TN1 responds with an INFORMATIONAL response with no payload to the NUT. All RESERVED fields in the message are set to one. 9. Observe the messages transmitted on Link A.
Part A Step 2: Judgment #1 The NUT transmits an IKE_SA_INIT request including "ENCR_3DES", "PRF_HMAC_SHA1", "AUTH_HMAC_SHA1_96" and "D-H group 2" as proposed algorithms.
Step 4: Judgment #2 The NUT transmits an IKE_AUTH request including "ENCR_3DES", "AUTH_HMAC_SHA1_96" and "No Extended Sequence Numbers" as proposed algorithms.
Step 7: Judgment #3 The NUT transmits an INFORMATIONAL request followed by an Encrypted payload with no payloads contained in it.
Step 9: Judgment #4 The NUT never retransmit an INFORMATIONAL request.
* None.