So i searched for some time now, read the https://tools.ietf.org/html/rfc2409RFC and simply couldn't find an answer to why Main Mode needs static adresses.

The RFC states Aggressive Mode does not provide identity protection because it exposes the addresses unencrypted but where does the restriction of needing static ips for main mode come from?

The only hint I could find is this, but it seems a Cisco specific explanation and I am looking for a protocol specific explanation.

  • It's because of IPSec identities. Main mode exchanges 6 messages. The shared secret is generated before messages 5&6. At this time the responder doesn't know the initiator’s identity in order to associate the Pre-Shared-Key. The Initiator’s IP address is used to choose the correct PSK. This address has to be configured on the Responder which is what disallows dynamic addressing with PSK and main mode. If you use RSA instead of PSK, you can use dynamic addressing. – fencepencil Oct 9 '19 at 2:49
  • Thank you for your answer, but this brings up further questions. The RFC says "with Main Mode the key can only be identified by the IP address of the peers since HASH_I must be computed before the initiator has processed IDir". But it is not specified where Idii (ID initiator?) and Idir (ID Responder?) is calculated or set... Also some vendors allow the set custom Local and remote identifiers (e.g. FQDN or DynDNS or others) – joni_93 Oct 9 '19 at 9:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.