]> Cisco

30 International Pl Tewksbury MA 95134 United States noblea@cisco.com

Cisco

170 West Tasman Drive San Jose CA 95134 United States sgundave@cisco.com

Broadcom Corporation

3151 Zanker Road San Jose 95134 United States jouni.nospam@gmail.com

Broadcom Corporation

100 Mathilda Place Sunnyvale CA 94086 United States baboescu@broadcom.com>

Cisco

170 West Tasman Drive San Jose CA 95134 United States bew@cisco.com

P-CSCF P-CSCF Option for IKEv2 Proxy-Call Session Control Function IMS Option for IKEv2 This document defines two new configuration attributes for the Internet Key Exchange Protocol version 2 (IKEv2). These attributes can be used for carrying the IPv4 address and IPv6 address of the Proxy-Call Session Control Function (P-CSCF). When an IPsec gateway delivers these attributes to an IPsec client, the IPsec client can obtain the IPv4 and/or IPv6 address of the P-CSCF server located in the 3GPP network.

The Third Generation Partnership Project (3GPP) S2b reference point , specified by the 3GPP system architecture, defines a mechanism for allowing a mobile node (MN) attached in an untrusted, non-3GPP IP access network to securely connect to a 3GPP network and access IP services. In this scenario, the mobile node establishes an IPsec Encapsulating Security Payload (ESP) tunnel to the security gateway called the Evolved Packet Data Gateway (ePDG) that in turn establishes a Proxy Mobile IPv6 (PMIPv6) or GPRS Tunneling Protocol (GTP) tunnel to the Packet Data Network Gateway (PGW) where the mobile node's session is anchored. The below figure shows the interworking option for non-3GPP access over an untrusted access network. The Mobile Access Gateway (MAG) and the Local Mobility Anchor (LMA) functions are defined in . The ePDG and PGW functions are defined in . The IPsec ESP tunnel is used between the MN and the ePDG; either a PMIP or GTP tunnel is used between the ePDG and PGW.

| <------ PMIPv6/GTP ----->| ]]>

A mobile node in this scenario may potentially need to access the IP Multimedia Subsystem (IMS) services in the 3GPP network. The 3GPP IMS architecture is described in and . Currently, there are no attributes in IKEv2 that can be used for carrying these information elements. In the absence of these attributes, the mobile node needs to be statically configured with this information and this is proving to be an operational challenge. Any other approaches for discovering these functions (such as using DNS or DHCP) would result in obtaining configuration from the access network and not from the home network. Given that the above referenced 3GPP interface is primarily for allowing the mobile node to connect to the 3GPP network through an untrusted access network, the access network may not have any relation with the home network provider and may be unable to deliver the mobile node's home network configuration. This specification therefore defines two new IKEv2 attributes that allow an IPsec gateway to provide the IPv4 and/or IPv6 address of the P-CSCF server. These attributes can be exchanged by IKEv2 peers as part of the configuration payload exchange. The attributes follow the configuration attribute format defined in Section 3.15.1 of . Furthermore, providing the P-CSCF server address(es) in IKEv2 as a standard attribute(s) enables clients to directly access IMS services behind a VPN gateway without going through the 3GPP-specific interfaces.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 .

All the IKEv2-related terms used in this document are to be interpreted as defined in and . All the mobility-related terms are to be interpreted as defined in and . Additionally, this document uses the following terms: Proxy-Call Session Control Function (P-CSCF) The P-CSCF is the entry point to the 3GPP IMS and serves as the SIP outbound proxy for the mobile node. The mobile node performs SIP registration to 3GPP IMS and initiates SIP sessions via a P-CSCF. Evolved Packet Data Gateway (ePDG) This is a security gateway defined by the 3GPP system architecture. The protocol interfaces it supports include IKEv2 .

The P_CSCF_IP4_ADDRESS configuration attribute is formatted as follows:

Refer to the IKEv2 specification 20 Length of the IPv4 address field that follows. Possible values are (0) and (4). A value of (4) indicates the size of the 4-octet IPv4 address that follows. A value of (0) indicates that it's an empty attribute with a zero-length IPv4 address field primarily used as a request indicator. An IPv4 address of the P-CSCF server. The P_CSCF_IP4_ADDRESS configuration attribute provides an IPv4 address of a P-CSCF server within the network. If an instance of an empty P_CSCF_IP4_ADDRESS attribute with a zero-length IPv4 Address field is included by the mobile node, the responder MAY respond with zero, one, or more P_CSCF_IP4_ADDRESS attributes. If several P_CSCF_IP4_ADDRESS attributes are provided in one IKEv2 message, there is no implied order among the P_CSCF_IP4_ADDRESS attributes. However, a system architecture using this specification may be able to enforce some order at both the peers.

The P_CSCF_IP6_ADDRESS configuration attribute is formatted as follows:

Refer to the IKEv2 specification 21 Length of the IPv6 address field that follows. Possible values are (0) and (16). A value of (16) indicates the size of the 16-octet IPv6 address that follows. A value of (0) indicates that it's an empty attribute with a zero-length IPv6 address field primarily used as a request indicator. An IPv6 address of the P-CSCF server. The P_CSCF_IP6_ADDRESS configuration attribute provides an IPv6 address of a P-CSCF server within the network. If an instance of an empty P_CSCF_IP6_ADDRESS attribute with a zero-length IPv6 Address field is included by the mobile node, the responder MAY respond with zero, one, or more P_CSCF_IP6_ADDRESS attributes. If several P_CSCF_IP6_ADDRESS attributes are provided in one IKEv2 message, there is no implied order among the P_CSCF_IP6_ADDRESS attributes. However, a system architecture using this specification may be able to enforce some order at both the peers.

The mobile node MAY request the IP address of an P-CSCF server as shown below.

<-- HDR(IKE_SA_INIT), SAr1, KEr, Nr, [CERTREQ] HDR(IKE_AUTH), SK { IDi, CERT, [CERTREQ], AUTH, [IDr], CP(CFG_REQUEST) = { INTERNAL_IP4_ADDRESS(), INTERNAL_IP4_DNS(), P_CSCF_IP4_ADDRESS() }, SAi2, TSi = (0, 0-65535, 0.0.0.0-255.255.255.255), TSr = (0, 0-65535, 0.0.0.0-255.255.255.255) } --> <-- HDR(IKE_AUTH), SK { IDr, CERT, AUTH, CP(CFG_REPLY) = { INTERNAL_IP4_ADDRESS(192.0.2.234), P_CSCF_IP4_ADDRESS(192.0.2.1), P_CSCF_IP4_ADDRESS(192.0.2.4), INTERNAL_IP4_DNS(198.51.100.33) }, SAr2, TSi = (0, 0-65535, 192.0.2.234-192.0.2.234), TSr = (0, 0-65535, 0.0.0.0-255.255.255.255) } ]]>

Per this document, the following IANA actions have been completed. Action 1: This specification defines a new IKEv2 attribute for carrying the IPv4 address of the P-CSCF server. This attribute is defined in . It has been assigned value 20 from the "IKEv2 Configuration Payload Attribute Types" namespace defined in . Action 2: This specification defines a new IKEv2 attribute for carrying the IPv6 address of the P-CSCF server. This attribute is defined in . It has been assigned value 21 from the "IKEv2 Configuration Payload Attribute Types" namespace defined in .

This document is an extension to IKEv2 and therefore it inherits all the security properties of IKEv2. The two new IKEv2 attributes defined in this specification are for carrying the IPv4 and IPv6 address of the P-CSCF server. These attributes can be exchanged by IKE peers as part of the configuration payload, and the currently defined IKEv2 security framework provides the needed integrity and privacy protection for these attributes. Therefore, this specification does not introduce any new security vulnerabilities.

&rfc2119; &rfc7296; &rfc4303; &rfc5739; &rfc5213; &rfc5844; 3GPP 3GPP 3GPP

The authors would like to specially thank Tero Kivinen for the detailed reviews. The authors would also like to thank Vojislav Vucetic, Heather Sze, Sebastian Speicher, Maulik Vaidya, Ivo Sedlacek, Pierrick Siete, and Hui Deng for all the discussions related to this topic.