Last Modified: Jan 13, 2020
See more info
Known Affected Versions:
13.1.0, 188.8.131.52, 184.108.40.206, 220.127.116.11, 18.104.22.168, 22.214.171.124, 126.96.36.199, 188.8.131.52, 184.108.40.206, 13.1.1, 220.127.116.11, 18.104.22.168, 22.214.171.124, 126.96.36.199, 188.8.131.52, 13.1.3, 184.108.40.206, 220.127.116.11, 14.1.0, 18.104.22.168, 22.214.171.124, 126.96.36.199, 188.8.131.52, 184.108.40.206, 220.127.116.11, 14.1.2, 18.104.22.168, 22.214.171.124, 126.96.36.199
Opened: Apr 17, 2018
IKEv2 only has a very inconvenient way to specify ID for an ike-peer when using peers-id-type asn1dn. The string value of peers-id-value was understood only as a file path, and not as a representation of the asn1dn value itself. The file had to be a certificate, whose subject happened to be the ID of the remote peer as a distinguished name (DN), so this could be extracted as binary DER for asn1dn. This was both awkward and error prone, requiring what amounts to a copy of a peer's certificate before it is sent during negotiation.
Very difficult to use asn1dn as the ID of a peer, impeding inter-operation with other vendors.
-- Using certificate based authentication in IPsec IKEv2. -- Configuring an ike-peer with peers-id-type as asn1dn.
If you can install a local copy of the peer's certificate, with an asn1dn value inside matching what that peer will actually send in an IKE_AUTH exchange, IKEv2 can extract the asn1dn provided the value of peers-id-value is an absolute file system path to this local certificate copy.
The BIG-IP now understands three different ways to express asn1dn inside the peers-id-value string: hexadecimal, distinguished name (DN), and (as a fallback default only) the literal content of the peers-id-value string unchanged. This last is not recommended since it will not be valid asn1dn. Parsing rules are the following: * A string containing equal sign ('=') is assumed a DN. * Otherwise a string is hexadecimal, if it contains only hex digits as well as any number of optional spaces and octothorpes ('#'). Spaces and '#' bytes are ignored, so only hex digits get converted to binary. * Any string parsed as neither DN nor hex is kept as is. Note: An example DN (distinguished name) from rfc1779 is "CN=Steve Kille, O=ISODE Consortium, C=GB". This is the sort of input converted to asn1dn when the value contains at least one equal sign.