NAME

  HTR_E_Out_2SA_SspiDipdst - Host Transport Mode ESP Outbound 2 SA selection, Same SPI, Different IPdst
  


TARGET

  Host


SYNOPSIS

  HTR_E_Out_2SA_SspiDipdst.seq [-tooloption ...] -pkt HTR_E_2SA_SspiDip.def
    -tooloption : v6eval tool option
  See also HTR_E_common.def and HTR_common.def


INITIALIZATION

For details of Network Topology, see 00README

Set NUT's SAD and SPD as following:

              NET5      NET3
    HOST1_NET5 -- Router -- NUT
         <----transport------ (SA1)
    HOST2_NET5
         <----transport------ (SA2)

Security Association Database (SAD) for SA1

source address NUT_NET3
destination address HOST1_NET5
SPI 0x1000
mode transport
protocol ESP
ESP algorithm DES-CBC
ESP algorithm key 01234567

Security Policy Database (SPD) for SA1

source address NUT_NET3
destination address HOST1_NET5
upper spec any
direction out
protocol ESP
mode transport

Security Association Database (SAD) for SA2

source address NUT_NET3
destination address HOST2_NET5
SPI 0x1000
mode transport
protocol ESP
ESP algorithm DES-CBC
ESP algorithm key foo0foo1

Security Policy Database (SPD) for SA2

source address NUT_NET3
destination address HOST2_NET5
upper spec any
direction out
protocol ESP
mode transport


TEST PROCEDURE

 Tester                      Target
   |                           |
   |-------------------------->|
   |      ICMP Echo Request    |
   |        From Host1         |
   |                           |
   |<--------------------------|
   |      ICMP Echo Reply      |
   |         To Host1          |
   |        (using SA1)        |
   |                           |
   |                           |
   |-------------------------->|
   |      ICMP Echo Request    |
   |        From Host2         |
   |                           |
   |<--------------------------|
   |      ICMP Echo Reply      |
   |         To Host2          |
   |        (using SA2)        |
   |                           |
   v                           v
  1. Send ICMP Echo Request from Host1
  2. Receive ICMP Echo Reply using SA1 to Host1
  3. Send ICMP Echo Request from Host2
  4. Receive ICMP Echo Reply using SA2 to Host2

ICMP Echo Request from Host1

IP Header Source Address HOST1_NET5
Destination Address NUT_NET3
ICMP Type 128 (Echo Request)

ICMP Echo Reply using SA1 to Host1

IP Header Source Address NUT_NET3
Destination Address HOST1_NET5
ESP SPI 0x1000
Algorithm DES-CBC
Key 01234567
ICMP Type 129 (Echo Reply)

ICMP Echo Request from Host2

IP Header Source Address HOST2_NET5
Destination Address NUT_NET3
ICMP Type 128 (Echo Request)

ICMP Echo Reply using SA2 to Host2

IP Header Source Address NUT_NET3
Destination Address HOST2_NET5
ESP SPI 0x1000
Algorithm DES-CBC
Key foo0foo1
ICMP Type 129 (Echo Reply)


JUDGEMENT

  PASS: Both ICMP Echo Reply with ESP (using SA1, SA2) received


SEE ALSO

  perldoc V6evalTool
  IPSEC.html IPsec Test Common Utility