AH Transport to ESP Transport mode (HOST)
[IP][AH][ESP]

[Interoperability Test Scenario]

Last Update: February 26, 2000

This scenario verifies interoperability when the target HOST is attached to the model network.

Subjects:

Verification of host's action.
Authentication Header transport mode to ESP transport mode packet.
Verification Points:

- Authentication algorithm

HMAC-MD5
HMAC-SHA1

- Encryption algorithm

NULL
DES-CBC

- MODE:

transport

- Granularity:

HOST

Logical Network Configuration:

            Host-1 ------ ROUTER-1 ------- Host-2
             | |                            ^ ^
             | |                            | |
             | +-----SA2(AH  Transport)-----+ |
             |                                |
             +-------SA1(ESP Transport)-------+


            Host-1 ------ ROUTER-1 ------- Host-2
             ^ ^                            | |
             | |                            | |
             | +-----SA2(AH  Transport)-----+ |
             |                                |
             +-------SA1(ESP Transport)-------+

Physical Network Configuration:

               HOST-2
                 |(HIF-2y) (3ffe:501:481d:f002::11)
                 |
      (Net-y)  --+-----+------------- (3ffe:501:481d:f002::/64)
                       |
                       |(I/F-y) (3ffe:501:481d:f002::1)
                    ROUTER-1
                       |(I/F-z) (3ffe:501:481d:f001::1)
                       |
      (Net-z)  --+-----+------------- (3ffe:501:481d:f001::/64)
                 |
                 |(HIF-1z) (3ffe:501:481d:f001::11)
               HOST-1

Network	Prefix	Network media
Net-y	3ffe:501:481d:f002::/64	Ethernet 10BASE-T
Net-z	3ffe:501:481d:f001::/64	Ethernet 10BASE-T

Test Machine:

Machine Comments Initial status Configuration

HOST-2 Target Machine Is attached to Net-y with power turned off. -

ROUTER-1 Reference Machine Power is turned off. I/F-z is attached to Net-z while I/F-y is attached to Net-y. Sends RA to Net-z and Net-y.
Sends and receives RIPng..

HOST-1 Reference Machine Is attached to Net-z with power turned off. -

Configuration list:

*AH auth = AH Authentication Algorithm
*ESP enc = ESP Encryption Algorithm
*ESP auth = ESP Authentication Algorithm

No. Machine Src Dest Protocol Mode SPI AH auth ESP enc ESP auth Upper Port(Src/Dst)

1
HOST-1 HIF-1y HIF-3x ESP Transport 1011 - NULL HMAC-MD5 any -

HIF-1y HIF-3x AH Transport 1012 HMAC-MD5 - - any -

HOST-2 HIF-3x HIF-1y ESP Transport 5011 - NULL HMAC-MD5 any -

HIF-3x HIF-1y AH Transport 5012 HMAC-MD5 - - any -

2
HOST-1 HIF-1y HIF-3x ESP Transport 1021 - NULL HMAC-MD5 any -

HIF-1y HIF-3x AH Transport 1022 HMAC-SHA1 - - any -

HOST-2 HIF-3x HIF-1y ESP Transport 5021 - NULL HMAC-MD5 any -

HIF-3x HIF-1y AH Transport 5022 HMAC-SHA1 - - any -

3
HOST-1 HIF-1y HIF-3x ESP Transport 1031 - DES-CBC HMAC-MD5 any -

HIF-1y HIF-3x AH Transport 1032 HMAC-MD5 - - any -

HOST-2 HIF-3x HIF-1y ESP Transport 5031 - DES-CBC HMAC-MD5 any -

HIF-3x HIF-1y AH Transport 5032 HMAC-MD5 - - any -

4
HOST-1 HIF-1y HIF-3x ESP Transport 1041 - DES-CBC HMAC-MD5 any -

HIF-1y HIF-3x AH Transport 1042 HMAC-SHA1 - - any -

HOST-2 HIF-3x HIF-1y ESP Transport 5041 - DES-CBC HMAC-MD5 any -

HIF-3x HIF-1y AH Transport 5042 HMAC-SHA1 - - any -

Applications:
ping program (ping)

NOTE:
We select only ping.
About other applications or protocols we prepare other scenarios.

Interoperability check

No Action Criteria Comments

Address auto configuration check.

1 Boot ROUTER-1. - -

2 Boot HOST-1. - -

3 Boot HOST-2. - -

Availability confirmation.

4 At HOST-1, run "ping" to HOST-2.
Repeat 10 times, with 1452 bytes ICMP payload, interval 1 second.
Ex) # ping6 -I ed0 -s 1452 -i 1 -c 10 HOST-2 *HOST-1 sends ICMP Echo Request to HOST-2.
*HOST-1 receives ICMP Echo Reply from HOST-2. HOST-1 and HOTS-2 don't use IPsec.

IPsec transport [IP][AH][ESP] (AH auth=HMAC-MD5) (ESP enc=NULL) (ESP auth=HMAC-MD5)

5 At HOST-1 set configuration #1 - -

6 At HOST-2 set configuration #1 - -

7 At HOST-1, run "ping" to HOST-2.
Repeat 10 times, with 64 bytes ICMP payload, interval 1 second.
Ex) # ping6 -I ed0 -s 64 -i 1 -c 10 HOST-2 *HOST-1 sends ICMP Echo Request to HOST-2.
*HOST-1 receives ICMP Echo Reply from HOST-2.
*AH and ESP header are attached to original packet with transport mode between HOST-1 and HOST-2. AH auth = HMAC-MD5
ESP enc = NULL
ESP auth = HMAC-MD5
HOST-1 <-> HOST-2
(ICMP)

8 At HOST-1, run "ping" to HOST-2.
Repeat 10 times, with 2000 bytes ICMP payload, interval 1 second.
Ex) # ping6 -I ed0 -s 2000 -i 1 -c 10 HOST-2 *HOST-1 sends ICMP Echo Request to HOST-2.
*HOST-1 receives ICMP Echo Reply from HOST-2.
*AH and ESP header are attached to original packet with transport mode between HOST-1 and HOST-2. AH auth = HMAC-MD5
ESP enc = NULL
ESP auth = HMAC-MD5
HOST-1 <-> HOST-2
The packet will be fragmented to 2 packets.
(ICMP)

9 At HOST-1, run "ping" to HOST-2.
Repeat 10 times, with 3000 bytes ICMP payload, interval 1 second.
Ex) # ping6 -I ed0 -s 3000 -i 1 -c 10 HOST-2. *HOST-1 sends ICMP Echo Request to HOST-2.
*HOST-1 receives ICMP Echo Reply from HOST-2.
*AH and ESP header are attached to original packet with transport mode between HOST-1 and HOST-2. AH auth = HMAC-MD5
ESP enc = NULL
ESP auth = HMAC-MD5
HOST-1 <-> HOST-2
The packet will be fragmented to 3 packets.
(ICMP)

IPsec transport [IP][AH][ESP] (AH auth=HMAC-SHA1) (ESP enc=NULL) (ESP auth=HMAC-MD5)

10 At HOST-1 set configuration #2 - -

11 At HOST-2 set configuration #2 - -

12 At HOST-1, run "ping" to HOST-2.
Repeat 10 times, with 64 bytes ICMP payload, interval 1 second.
Ex) # ping6 -I ed0 -s 64 -i 1 -c 10 HOST-2. *HOST-1 sends ICMP Echo Request to HOST-2.
*HOST-1 receives ICMP Echo Reply from HOST-2.
*AH and ESP header are attached to original packet with transport mode between HOST-1 and HOST-2. AH auth = HMAC-SHA1
ESP enc = NULL
ESP auth = HMAC-MD5
HOST-1 <-> HOST-2
(ICMP)

13 At HOST-1, run "ping" to HOST-2.
Repeat 10 times, with 2000 bytes ICMP payload, interval 1 second.
Ex) # ping6 -I ed0 -s 2000 -i 1 -c 10 HOST-2. *HOST-1 sends ICMP Echo Request to HOST-2.
*HOST-1 receives ICMP Echo Reply from HOST-2.
*AH and ESP header are attached to original packet with transport mode between HOST-1 and HOST-2. AH auth = HMAC-SHA1
ESP enc = NULL
ESP auth = HMAC-MD5
HOST-1 <-> HOST-2
The packet will be fragmented to 2 packets.
(ICMP)

14 At HOST-1, run "ping" to HOST-2.
Repeat 10 times, with 3000 bytes ICMP payload, interval 1 second.
Ex) # ping6 -I ed0 -s 3000 -i 1 -c 10 HOST-2. *HOST-1 sends ICMP Echo Request to HOST-2.
*HOST-1 receives ICMP Echo Reply from HOST-2.
*AH and ESP header are attached to original packet with transport mode between HOST-1 and HOST-2. AH auth = HMAC-SHA1
ESP enc = NULL
ESP auth = HMAC-MD5
HOST-1 <-> HOST-2
The packet will be fragmented to 3 packets.
(ICMP)

IPsec transport [IP][AH][ESP] (AH auth=HMAC-MD5) (ESP enc=DES-CBC) (ESP auth=HMAC-MD5)

15 At HOST-1 set configuration #3 - -

16 At HOST-2 set configuration #3 - -

17 At HOST-1, run "ping" to HOST-2.
Repeat 10 times, with 64 bytes ICMP payload, interval 1 second.
Ex) # ping6 -I ed0 -s 64 -i 1 -c 10 HOST-2. *HOST-1 sends ICMP Echo Request to HOST-2.
*HOST-1 receives ICMP Echo Reply from HOST-2.
*AH and ESP header are attached to original packet with transport mode between HOST-1 and HOST-2. AH auth = HMAC-MD5
ESP enc = DES-CBC ESP auth = HMAC-MD5
HOST-1 <-> HOST-2
(ICMP)

18 At HOST-1, run "ping" to HOST-2.
Repeat 10 times, with 2000 bytes ICMP payload, interval 1 second.
Ex) # ping6 -I ed0 -s 2000 -i 1 -c 10 HOST-2. *HOST-1 sends ICMP Echo Request to HOST-2.
*HOST-1 receives ICMP Echo Reply from HOST-2.
*AH and ESP header are attached to original packet with transport mode between HOST-1 and HOST-2. AH auth = HMAC-MD5
ESP enc = DES-CBC
ESP auth = HMAC-MD5
HOST-1 <-> HOST-2
The packet will be fragmented to 2 packets.
(ICMP)

19 At HOST-1, run "ping" to HOST-2.
Repeat 10 times, with 3000 bytes ICMP payload, interval 1 second.
Ex) # ping6 -I ed0 -s 3000 -i 1 -c 10 HOST-2. *HOST-1 sends ICMP Echo Request to HOST-2.
*HOST-1 receives ICMP Echo Reply from HOST-2.
*AH and ESP header are attached to original packet with transport mode between HOST-1 and HOST-2. AH auth = HMAC-MD5
ESP enc = DES-CBC
ESP auth = HMAC-MD5
HOST-1 <-> HOST-2
The packet will be fragmented to 3 packets.
(ICMP)

IPsec transport [IP][AH][ESP] (AH auth=HMAC-SHA1) (ESP enc=DES-CBC) (ESP auth=HMAC-MD5)

20 At HOST-1 set configuration #4 - -

21 At HOST-2 set configuration #4 - -

22 At HOST-1, run "ping" to HOST-2.
Repeat 10 times, with 64 bytes ICMP payload, interval 1 second.
Ex) # ping6 -I ed0 -s 64 -i 1 -c 10 HOST-2. *HOST-1 sends ICMP Echo Request to HOST-2.
*HOST-1 receives ICMP Echo Reply from HOST-2.
*AH and ESP header are attached to original packet with transport mode between HOST-1 and HOST-2. AH auth = HMAC-SHA1
ESP enc = DES-CBC ESP auth = HMAC-MD5
HOST-1 <-> HOST-2
(ICMP)

23 At HOST-1, run "ping" to HOST-2.
Repeat 10 times, with 2000 bytes ICMP payload, interval 1 second.
Ex) # ping6 -I ed0 -s 2000 -i 1 -c 10 HOST-2. *HOST-1 sends ICMP Echo Request to HOST-2.
*HOST-1 receives ICMP Echo Reply from HOST-2.
*AH and ESP header are attached to original packet with transport mode between HOST-1 and HOST-2. AH auth = HMAC-SHA1
ESP enc = DES-CBC
ESP auth = HMAC-MD5
HOST-1 <-> HOST-2
The packet will be fragmented to 2 packets.
(ICMP)

24 At HOST-1, run "ping" to HOST-2.
Repeat 10 times, with 3000 bytes ICMP payload, interval 1 second.
Ex) # ping6 -I ed0 -s 3000 -i 1 -c 10 HOST-2. *HOST-1 sends ICMP Echo Request to HOST-2.
*HOST-1 receives ICMP Echo Reply from HOST-2.
*AH and ESP header are attached to original packet with transport mode between HOST-1 and HOST-2. AH auth = HMAC-SHA1
ESP enc = DES-CBC
ESP auth = HMAC-MD5
HOST-1 <-> HOST-2
The packet will be fragmented to 3 packets.
(ICMP)

Mark"*"with no number means that we are going to judge that subject.

No	Action	Criteria	Comments
Address auto configuration check.
1	Boot ROUTER-1.	-	-
2	Boot HOST-1.	-	-
3	Boot HOST-2.	-	-
Availability confirmation.
4	At HOST-1, run "ping" to HOST-2. Repeat 10 times, with 1452 bytes ICMP payload, interval 1 second. Ex) # ping6 -I ed0 -s 1452 -i 1 -c 10 HOST-2	HOST-1 sends ICMP Echo Request to HOST-2. HOST-1 receives ICMP Echo Reply from HOST-2.	HOST-1 and HOTS-2 don't use IPsec.
IPsec transport [IP][AH][ESP] (AH auth=HMAC-MD5) (ESP enc=NULL) (ESP auth=HMAC-MD5)
5	At HOST-1 set configuration #1	-	-
6	At HOST-2 set configuration #1	-	-
7	At HOST-1, run "ping" to HOST-2. Repeat 10 times, with 64 bytes ICMP payload, interval 1 second. Ex) # ping6 -I ed0 -s 64 -i 1 -c 10 HOST-2	HOST-1 sends ICMP Echo Request to HOST-2. HOST-1 receives ICMP Echo Reply from HOST-2. *AH and ESP header are attached to original packet with transport mode between HOST-1 and HOST-2.	AH auth = HMAC-MD5 ESP enc = NULL ESP auth = HMAC-MD5 HOST-1 <-> HOST-2 (ICMP)
8	At HOST-1, run "ping" to HOST-2. Repeat 10 times, with 2000 bytes ICMP payload, interval 1 second. Ex) # ping6 -I ed0 -s 2000 -i 1 -c 10 HOST-2	HOST-1 sends ICMP Echo Request to HOST-2. HOST-1 receives ICMP Echo Reply from HOST-2. *AH and ESP header are attached to original packet with transport mode between HOST-1 and HOST-2.	AH auth = HMAC-MD5 ESP enc = NULL ESP auth = HMAC-MD5 HOST-1 <-> HOST-2 The packet will be fragmented to 2 packets. (ICMP)
9	At HOST-1, run "ping" to HOST-2. Repeat 10 times, with 3000 bytes ICMP payload, interval 1 second. Ex) # ping6 -I ed0 -s 3000 -i 1 -c 10 HOST-2.	HOST-1 sends ICMP Echo Request to HOST-2. HOST-1 receives ICMP Echo Reply from HOST-2. *AH and ESP header are attached to original packet with transport mode between HOST-1 and HOST-2.	AH auth = HMAC-MD5 ESP enc = NULL ESP auth = HMAC-MD5 HOST-1 <-> HOST-2 The packet will be fragmented to 3 packets. (ICMP)
IPsec transport [IP][AH][ESP] (AH auth=HMAC-SHA1) (ESP enc=NULL) (ESP auth=HMAC-MD5)
10	At HOST-1 set configuration #2	-	-
11	At HOST-2 set configuration #2	-	-
12	At HOST-1, run "ping" to HOST-2. Repeat 10 times, with 64 bytes ICMP payload, interval 1 second. Ex) # ping6 -I ed0 -s 64 -i 1 -c 10 HOST-2.	HOST-1 sends ICMP Echo Request to HOST-2. HOST-1 receives ICMP Echo Reply from HOST-2. *AH and ESP header are attached to original packet with transport mode between HOST-1 and HOST-2.	AH auth = HMAC-SHA1 ESP enc = NULL ESP auth = HMAC-MD5 HOST-1 <-> HOST-2 (ICMP)
13	At HOST-1, run "ping" to HOST-2. Repeat 10 times, with 2000 bytes ICMP payload, interval 1 second. Ex) # ping6 -I ed0 -s 2000 -i 1 -c 10 HOST-2.	HOST-1 sends ICMP Echo Request to HOST-2. HOST-1 receives ICMP Echo Reply from HOST-2. *AH and ESP header are attached to original packet with transport mode between HOST-1 and HOST-2.	AH auth = HMAC-SHA1 ESP enc = NULL ESP auth = HMAC-MD5 HOST-1 <-> HOST-2 The packet will be fragmented to 2 packets. (ICMP)
14	At HOST-1, run "ping" to HOST-2. Repeat 10 times, with 3000 bytes ICMP payload, interval 1 second. Ex) # ping6 -I ed0 -s 3000 -i 1 -c 10 HOST-2.	HOST-1 sends ICMP Echo Request to HOST-2. HOST-1 receives ICMP Echo Reply from HOST-2. *AH and ESP header are attached to original packet with transport mode between HOST-1 and HOST-2.	AH auth = HMAC-SHA1 ESP enc = NULL ESP auth = HMAC-MD5 HOST-1 <-> HOST-2 The packet will be fragmented to 3 packets. (ICMP)
IPsec transport [IP][AH][ESP] (AH auth=HMAC-MD5) (ESP enc=DES-CBC) (ESP auth=HMAC-MD5)
15	At HOST-1 set configuration #3	-	-
16	At HOST-2 set configuration #3	-	-
17	At HOST-1, run "ping" to HOST-2. Repeat 10 times, with 64 bytes ICMP payload, interval 1 second. Ex) # ping6 -I ed0 -s 64 -i 1 -c 10 HOST-2.	HOST-1 sends ICMP Echo Request to HOST-2. HOST-1 receives ICMP Echo Reply from HOST-2. *AH and ESP header are attached to original packet with transport mode between HOST-1 and HOST-2.	AH auth = HMAC-MD5 ESP enc = DES-CBC ESP auth = HMAC-MD5 HOST-1 <-> HOST-2 (ICMP)
18	At HOST-1, run "ping" to HOST-2. Repeat 10 times, with 2000 bytes ICMP payload, interval 1 second. Ex) # ping6 -I ed0 -s 2000 -i 1 -c 10 HOST-2.	HOST-1 sends ICMP Echo Request to HOST-2. HOST-1 receives ICMP Echo Reply from HOST-2. *AH and ESP header are attached to original packet with transport mode between HOST-1 and HOST-2.	AH auth = HMAC-MD5 ESP enc = DES-CBC ESP auth = HMAC-MD5 HOST-1 <-> HOST-2 The packet will be fragmented to 2 packets. (ICMP)
19	At HOST-1, run "ping" to HOST-2. Repeat 10 times, with 3000 bytes ICMP payload, interval 1 second. Ex) # ping6 -I ed0 -s 3000 -i 1 -c 10 HOST-2.	HOST-1 sends ICMP Echo Request to HOST-2. HOST-1 receives ICMP Echo Reply from HOST-2. *AH and ESP header are attached to original packet with transport mode between HOST-1 and HOST-2.	AH auth = HMAC-MD5 ESP enc = DES-CBC ESP auth = HMAC-MD5 HOST-1 <-> HOST-2 The packet will be fragmented to 3 packets. (ICMP)
IPsec transport [IP][AH][ESP] (AH auth=HMAC-SHA1) (ESP enc=DES-CBC) (ESP auth=HMAC-MD5)
20	At HOST-1 set configuration #4	-	-
21	At HOST-2 set configuration #4	-	-
22	At HOST-1, run "ping" to HOST-2. Repeat 10 times, with 64 bytes ICMP payload, interval 1 second. Ex) # ping6 -I ed0 -s 64 -i 1 -c 10 HOST-2.	HOST-1 sends ICMP Echo Request to HOST-2. HOST-1 receives ICMP Echo Reply from HOST-2. *AH and ESP header are attached to original packet with transport mode between HOST-1 and HOST-2.	AH auth = HMAC-SHA1 ESP enc = DES-CBC ESP auth = HMAC-MD5 HOST-1 <-> HOST-2 (ICMP)
23	At HOST-1, run "ping" to HOST-2. Repeat 10 times, with 2000 bytes ICMP payload, interval 1 second. Ex) # ping6 -I ed0 -s 2000 -i 1 -c 10 HOST-2.	HOST-1 sends ICMP Echo Request to HOST-2. HOST-1 receives ICMP Echo Reply from HOST-2. *AH and ESP header are attached to original packet with transport mode between HOST-1 and HOST-2.	AH auth = HMAC-SHA1 ESP enc = DES-CBC ESP auth = HMAC-MD5 HOST-1 <-> HOST-2 The packet will be fragmented to 2 packets. (ICMP)
24	At HOST-1, run "ping" to HOST-2. Repeat 10 times, with 3000 bytes ICMP payload, interval 1 second. Ex) # ping6 -I ed0 -s 3000 -i 1 -c 10 HOST-2.	HOST-1 sends ICMP Echo Request to HOST-2. HOST-1 receives ICMP Echo Reply from HOST-2. *AH and ESP header are attached to original packet with transport mode between HOST-1 and HOST-2.	AH auth = HMAC-SHA1 ESP enc = DES-CBC ESP auth = HMAC-MD5 HOST-1 <-> HOST-2 The packet will be fragmented to 3 packets. (ICMP)

Machine	Comments	Initial status	Configuration
HOST-2	Target Machine	Is attached to Net-y with power turned off.	-
ROUTER-1	Reference Machine	Power is turned off. I/F-z is attached to Net-z while I/F-y is attached to Net-y.	Sends RA to Net-z and Net-y. Sends and receives RIPng..
HOST-1	Reference Machine	Is attached to Net-z with power turned off.	-

No.	Machine	Src	Dest	Protocol	Mode	SPI	AH auth	ESP enc	ESP auth	Upper	Port(Src/Dst)
1	HOST-1	HIF-1y	HIF-3x	ESP	Transport	1011	-	NULL	HMAC-MD5	any	-
	HOST-1	HIF-1y	HIF-3x	AH	Transport	1012	HMAC-MD5	-	-	any	-
	HOST-2	HIF-3x	HIF-1y	ESP	Transport	5011	-	NULL	HMAC-MD5	any	-
	HOST-2	HIF-3x	HIF-1y	AH	Transport	5012	HMAC-MD5	-	-	any	-
2	HOST-1	HIF-1y	HIF-3x	ESP	Transport	1021	-	NULL	HMAC-MD5	any	-
	HOST-1	HIF-1y	HIF-3x	AH	Transport	1022	HMAC-SHA1	-	-	any	-
	HOST-2	HIF-3x	HIF-1y	ESP	Transport	5021	-	NULL	HMAC-MD5	any	-
	HOST-2	HIF-3x	HIF-1y	AH	Transport	5022	HMAC-SHA1	-	-	any	-
3	HOST-1	HIF-1y	HIF-3x	ESP	Transport	1031	-	DES-CBC	HMAC-MD5	any	-
	HOST-1	HIF-1y	HIF-3x	AH	Transport	1032	HMAC-MD5	-	-	any	-
	HOST-2	HIF-3x	HIF-1y	ESP	Transport	5031	-	DES-CBC	HMAC-MD5	any	-
	HOST-2	HIF-3x	HIF-1y	AH	Transport	5032	HMAC-MD5	-	-	any	-
4	HOST-1	HIF-1y	HIF-3x	ESP	Transport	1041	-	DES-CBC	HMAC-MD5	any	-
	HOST-1	HIF-1y	HIF-3x	AH	Transport	1042	HMAC-SHA1	-	-	any	-
	HOST-2	HIF-3x	HIF-1y	ESP	Transport	5041	-	DES-CBC	HMAC-MD5	any	-
	HOST-2	HIF-3x	HIF-1y	AH	Transport	5042	HMAC-SHA1	-	-	any	-

AH Transport to ESP Transport mode (HOST) [IP][AH][ESP]

[Interoperability Test Scenario]

AH Transport to ESP Transport mode (HOST)
[IP][AH][ESP]