Subject: [Ipsec] ipsec packet passage through IPSEC and FIREWALL enabled router

From: "M.Chenna kesava Reddy" <[email-masked]>
Date: Fri, 03 Sep 2004 15:54:45 +0530

Hi,
I have some doubts regarding how the ipsec fits in to the security 
router in tunnel mode ,
please clarify.
Packet comming from internet with ipsec in tunnel mode to local lan :
eth0---<ethernet>---<Ip lookup>---<ipsec Decr>---<SNAT>---<ethernet>---eth1
Packet from ipsec Decryption will comes back to look up on inner ip header
Here in tunnel mode outer ip header destination ip address will be SG 
address, and once
it is decrypted it will give AH/ESP payload i.e inner IP packet back to  
Ip  look up and
it will look like comes with eth1 destined for local lan, and if we 
apply SNAT it will
change the source address. I think SNAT won't for this ipsec packet.

Packet comming from lan to internet in tunnel mode:

eth1---<ethernet>---<lookup>--<OuterIP as SG ip and ipsec Enc>-- 
--<DNAT>---<ethernet>---eth0
Packet from ipsec Encryption  will comes back to look up on Outer ip 
header added by ipsec

Here in tunnel mode outer ip header is added as source ip address will 
be SG address, and once
it is encrypted the packet looks like  inner IP packet is as is sent by 
local lan host and goes back to
Ip  look up  and it will look like comes with eth1 destined for local 
lan, and if we apply DNAT it will
change the destination ip address.I think DNAT won't work for ipsec 
packets.

Please clarify me how ipsec works in SNAT and DNAT cases and in SPD 
policy says 10.1.1.1/24 to
20.1.2.3/24  Lans configured in Tunnel mode.
What will be the SA's in this case is it source ip SG1 to destination ip 
SG2 or it is Lan ip's only.

Thanks in advance,

Regards
mcreddy

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec