Network Security
Configure IKEv2 Traffic Selectors
Table of Contents
Configure IKEv2 Traffic Selectors
| Where Can I Use This? | What Do I Need? |
|---|---|
| No license required |
In IKEv1, a firewall that has a route-based VPN needs to use a local and remote Proxy
ID in order to set up an IPSec tunnel. Each peer compares its proxy IDs with what it
received in the packet to negotiate IKE Phase 2 successfully. IKE Phase 2 is about
negotiating the SAs to set up an IPSec tunnel. (For more information on Proxy IDs,
see Tunnel Interface.)
In IKEv2, you can configure traffic selectors, which are components of network traffic that are
used during IKE negotiation. Traffic selectors are used during the CHILD_SA (tunnel
creation) Phase 2 to set up the tunnel and to determine what traffic is allowed
through the tunnel. The two IKE gateway peers must negotiate and agree on their
traffic selectors; otherwise, one side narrows its address range to reach agreement.
One IKE connection can have multiple tunnels; for example, you can assign different
tunnels to each department to isolate their traffic. Separation of traffic also
allows features such as QoS to be implemented.
The IPv4 and IPv6 traffic selectors are:
- Source IP address—A network prefix, address range, specific host, or wildcard.
- Destination IP address—A network prefix, address range, specific host, or wildcard.
- Protocol—A transport protocol, such as TCP or UDP.
- Source port—The port where the packet originated.
- Destination port—The port the packet is destined for.
During IKE negotiation, there can be multiple traffic selectors for different
networks and protocols. For example, the Initiator might indicate that it wants to
send TCP packets from 172.168.0.0/16 through the tunnel to its peer, destined for
198.5.0.0/16. It also wants to send UDP packets from 172.17.0.0/16 through the same
tunnel to the same gateway, destined for 0.0.0.0 (any network). The peer gateway
must agree to these traffic selectors so that it knows what to expect.
It’s possible that one gateway will start negotiation using a traffic selector that
is a more specific IP address than the IP address of the other gateway.
- For example, gateway A offers a source IP address of 172.16.0.0/16 and a destination IP address of 192.16.0.0/16. But gateway B is configured with 0.0.0.0 (any source) as the source IP address and 0.0.0.0 (any destination) as the destination IP address. Therefore, gateway B narrows down its source IP address to 192.16.0.0/16 and its destination address to 172.16.0.0/16. Thus, the narrowing down accommodates the addresses of gateway A and the traffic selectors of the two gateways are in agreement.
- If gateway B (configured with source IP address 0.0.0.0) is the Initiator instead of the Responder, gateway A will respond with its more specific IP addresses, and gateway B will narrow down its addresses to reach agreement.
Use the following workflow to configure traffic selectors.
- Select .Select the IPv4 or IPv6 tab.Click Add and enter the Name in the Proxy ID field.In the Local field, enter the Source IP Address.In the Remote field, enter the Destination IP Address.In the Protocol field, select the transport protocol (TCP or UDP).Click OK.
