9

From my understanding, for incoming packets over IPSec, the Security Association (SA) is identified by the SPI field of the ESP header.

Then let's say I have a bunch of nodes where each node wants to be able to talk to each other node using IPSec tunnels (so n nodes, each of which talk to n-1 other nodes). If that is the case, no SPI value can be used for more than one SA and since there are 2 SAs between each pair of nodes, and since SPI is a 32-bit field, is it correct that there can only be ~65535 nodes in such a configuration?

If so, is there a way to have more nodes in such a configuration? The practicality of this "configuration" is a separate matter.

11
  • 1
    An SA is uniquely identified by both a SPI as well as a Destination Address. This means that you could theoretically have a single SPI for multiple destination nodes that would still uniquely be identified. This would increase the number of nodes that could be connected.
    – RoraΖ
    Commented Sep 14, 2014 at 21:39
  • I thought about that but because of an unusual situation, the addresses might change frequently, so using the dest/src address isn't reliable.
    – mmtauqir
    Commented Sep 15, 2014 at 11:43
  • What unusual situation? This configuration in general is unusual, and at a minimum impractical.
    – RoraΖ
    Commented Sep 15, 2014 at 12:20
  • Well, I would still like to have the original question answered, regardless of how how unusual/impractical it is. Let's call it an educational question.
    – mmtauqir
    Commented Sep 15, 2014 at 12:55
  • That's cool, I'm just curious as to what unusual situation makes the destination IP unreliable.
    – RoraΖ
    Commented Sep 15, 2014 at 13:00

1 Answer 1

1

The math...32 bits.

2^32 / 2 != 65535

2^32 = 4,294,967,296
4,294,967,296 / 2 = 2,147,483,648

You don't get IPSec without IP and IP defines a source and destination address in every packet. You'll always have a source/destination with each of our SAs.

That means your limit is 4,294,967,296 or 2,147,483,648 per IP address you communicate with because your software can keep track of the SA assigned to each IP.

@eddie clarified this answer in comments.

@Kasperd points out that it's possible that the limit is actually 2^32 without dividing by two. As pointed out in comments there is no requirement that the SPIs can't be the same in both directions because the receiver can see the peer IP address. So the max could be closer to 4,294,967,296.

You'll also notice that 2^32 is the entire IPv4 space, (discounting which are globally routable) and for this question, you will not run out of SPIs any time soon and I'm pretty sure other limits (memory, bandwidth, etc) will prevent you from exceeding a much smaller threshold.

4
  • What about broadcast addresses and all that jazz?
    – cutrightjm
    Commented Jul 29, 2015 at 23:13
  • @ekaj I think you are misunderstanding the answer. But I am not sure because this answer is a bit unclear to me, so maybe I am the one who is misunderstanding. There are 32 bits in the SPI, that gives 2³² combinations of which I think only one is reserved. I think that is the point of this answer. I have seen many cases of people mentioning the 2³² possible IPv4 addresses completely ignoring that only 3700 million are globally routable. But this answer doesn't look like one of those cases.
    – kasperd
    Commented Jul 31, 2015 at 6:47
  • @Kasperd correct. Jonathan is doing 2^32 since there are 32 bits in an SPI. He is also dividing by two because each IPsec conversation has a unique SPI for each direction of the conversation. AKA, If you and I were speaking IPsec to each other, we would be using two different SPIs -- one to encrypt/decrypt data sent from me to you, and the other to encrypt/decrypt data sent from you to me.
    – Eddie
    Commented Sep 22, 2015 at 18:58
  • @Eddie The SPI is chosen by the receiving end, so usually different SPI will be used for each direction, but sometimes by chance the same SPI will be chosen for both directions. There is nothing preventing a node from having more than 2³² security associations for outgoing traffic because as long as those destinations have different IP addresses the SPI need not be unique. A node is limited to 2³² security associations for incoming traffic, no need to divide by two.
    – kasperd
    Commented Sep 22, 2015 at 19:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .