Subject: [Ipsec] ipsec packet passage through IPSEC and FIREWALL enabled router

From: "M.Chenna kesava Reddy" <[email-masked]>
Date: Fri, 03 Sep 2004 15:54:45 +0530

Hi,
I have some doubts regarding how the ipsec fits in to the security 
router in tunnel mode ,
please clarify.
Packet comming from internet with ipsec in tunnel mode to local lan :
eth0---<ethernet>---<Ip lookup>---<ipsec Decr>---<SNAT>---<ethernet>---eth1
Packet from ipsec Decryption will comes back to look up on inner ip header
Here in tunnel mode outer ip header destination ip address will be SG 
address, and once
it is decrypted it will give AH/ESP payload i.e inner IP packet back to  
Ip  look up and
it will look like comes with eth1 destined for local lan, and if we 
apply SNAT it will
change the source address. I think SNAT won't for this ipsec packet.

Packet comming from lan to internet in tunnel mode:

eth1---<ethernet>---<lookup>--<OuterIP as SG ip and ipsec Enc>-- 
--<DNAT>---<ethernet>---eth0
Packet from ipsec Encryption  will comes back to look up on Outer ip 
header added by ipsec

Here in tunnel mode outer ip header is added as source ip address will 
be SG address, and once
it is encrypted the packet looks like  inner IP packet is as is sent by 
local lan host and goes back to
Ip  look up  and it will look like comes with eth1 destined for local 
lan, and if we apply DNAT it will
change the destination ip address.I think DNAT won't work for ipsec 
packets.

Please clarify me how ipsec works in SNAT and DNAT cases and in SPD 
policy says 10.1.1.1/24 to
20.1.2.3/24  Lans configured in Tunnel mode.
What will be the SA's in this case is it source ip SG1 to destination ip 
SG2 or it is Lan ip's only.

Thanks in advance,

Regards
mcreddy

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: "Srinivasa Rao Addepalli" <[email-masked]>
Date: Fri, 3 Sep 2004 11:50:36 -0700

I guess you are asking the case where IPSec and NAT functionality exist in
the same unit. 

Note that, NAT is not required, if the private networks behind security gateways
are under same administrator control.  Administrator can ensure that, unique
private IP address space is given to the networks under his control.

If above is not the case, then NAT is applied such that, the remote systems see
the public IP addresses (routable IP addresses).

For outbound packets (Clear to Secure)
     - NAT is done first.
     - Run through the IPSec Policies.
     - If IPSec policy indicates 'Apply',  packet is encrypted and outer IP header is added.

In tunnel, the outer IP header would have source IP is local gateway IP address and
destintion IP would be remote gateway IP address.
Internal IP header is not touched. 
At the remote SG, outer IP header is removed and the internal IP packet is sent out on 
its local network.

Srini

Intoto Inc.
www.intoto.com

---

From: "Srinivasa Rao Addepalli" <[email-masked]>
Date: Fri, 3 Sep 2004 11:50:36 -0700

Srini

Intoto Inc.
www.intoto.com

---

From: "M.Chenna kesava Reddy" <[email-masked]>
Date: Wed, 08 Sep 2004 13:23:20 +0530

Hi,
In the case of outbound packets if NAT is applied on the packets, it is 
any way changes the
inner ip header from say local lan ip address to public ip address, it 
may be to gateway ip
address(public) is it. so after NAT if  you search  the  ipsec policies 
with this address it may not
find correct SPD policy because the policy may be local lan subnet 
behind  this  gateway to
other local lan subnet behind peer gateway is it?
So I think the spd match will fail here is it.
so what is the solution for this to overcome.
I can think of is we have one solution saying that during configuration 
of SPD , we need to
allow only  gateway to gateway configuration of SPD not the local subnet 
to local subnet.

thx in advance,
mcreddy

---

From: "M.Chenna kesava Reddy" <[email-masked]>
Date: Wed, 08 Sep 2004 13:23:20 +0530

Hi,

thx in advance,
mcreddy

---

From: "Srinivasa Rao Addepalli" <[email-masked]>
Date: Wed, 8 Sep 2004 09:55:46 -0700

It depends on deployment scenario.

If the networks behind two SGs are under same administrative domain (Example branch office
connectivity), there is no need for NAT as these networks can be reached from one another.
In this SPD policy selectors would be IP address ranges of local networks.

If the networks under different administrative control, it is possible that both the networks having
same private subnet Or these two networks are not reachable from one anonther.
In this case, as you said, NAT is required and SPD policy selectors would need to have
NAT IP (Public IP)addresses.

Srini
Intoto Inc.
www.intoto.com
  ----- Original Message ----- 
  From: M.Chenna kesava Reddy 
  To: Srinivasa Rao Addepalli 
  Cc: ipsec ; ipsec 
  Sent: Wednesday, September 08, 2004 12:53 AM
  Subject: Re: [Ipsec] ipsec packet passage through IPSEC and FIREWALL enabledrouter

  Hi,
  In the case of outbound packets if NAT is applied on the packets, it is any way changes the
  inner ip header from say local lan ip address to public ip address, it may be to gateway ip
  address(public) is it. so after NAT if  you search  the  ipsec policies with this address it may not
  find correct SPD policy because the policy may be local lan subnet behind  this  gateway to 
  other local lan subnet behind peer gateway is it?
  So I think the spd match will fail here is it.
  so what is the solution for this to overcome.
  I can think of is we have one solution saying that during configuration of SPD , we need to
  allow only  gateway to gateway configuration of SPD not the local subnet to local subnet.

  thx in advance,
  mcreddy

Srini

Intoto Inc.
www.intoto.com
----- Original Message ----- 
From: "M.Chenna kesava Reddy" <[email-masked]>
To: "ipsec" <[email-masked]>; "ipsec" <[email-masked]>
Sent: Friday, September 03, 2004 3:24 AM
Subject: [Ipsec] ipsec packet passage through IPSEC and FIREWALL enabledrouter

  Hi,

Thanks in advance,

Regards
mcreddy

---

From: "M.Chenna kesava Reddy" <[email-masked]>
Date: Thu, 09 Sep 2004 21:05:56 +0530

Hi,
In the case of networks under different administrative control, NAT is 
applied and
SPD policy selectors are NAT(public IP) addresses, so In this case can I 
select tunnel
mode ??
If tunnel mode is selected then Inner ip ( NATed IP ) is same as outer 
ip address is it.

please clarify
Thx in advance
mcreddy

Srinivasa Rao Addepalli wrote:

> www.intoto.com <http://www.intoto.com>
>
>     From: M.Chenna kesava Reddy <mailto:[email-masked]>
>     To: Srinivasa Rao Addepalli <mailto:[email-masked]>
>     Cc: ipsec <mailto:[email-masked]> ; ipsec
>     <mailto:[email-masked]>

---

From: "Srinivasa Rao Addepalli" <[email-masked]>
Date: Thu, 9 Sep 2004 09:18:08 -0700

Yes. You can select tunnel mode. You are right that source IP in both inner and outer
IP header would be same, if same IP address is used as NAT IP and as well as local 
security gateway IP address.

Srini
Intoto Inc.
www.intoto.com
  ----- Original Message ----- 
  From: M.Chenna kesava Reddy 
  To: Srinivasa Rao Addepalli 
  Cc: ipsec 
  Sent: Thursday, September 09, 2004 8:35 AM
  Subject: Re: [Ipsec] ipsec packet passage through IPSEC and FIREWALLenabledrouter

  Hi,
  In the case of networks under different administrative control, NAT is applied and 
  SPD policy selectors are NAT(public IP) addresses, so In this case can I select tunnel
  mode ??
  If tunnel mode is selected then Inner ip ( NATed IP ) is same as outer ip address is it.

  please clarify
  Thx in advance
  mcreddy

    Srini
    Intoto Inc.
    www.intoto.com
      ----- Original Message ----- 
      From: M.Chenna kesava Reddy 
      To: Srinivasa Rao Addepalli 
      Cc: ipsec ; ipsec 
      Sent: Wednesday, September 08, 2004 12:53 AM
      Subject: Re: [Ipsec] ipsec packet passage through IPSEC and FIREWALL enabledrouter

      Hi,

      thx in advance,
      mcreddy

Srini

Intoto Inc.
www.intoto.com
----- Original Message ----- 
From: "M.Chenna kesava Reddy" <[email-masked]>
To: "ipsec" <[email-masked]>; "ipsec" <[email-masked]>
Sent: Friday, September 03, 2004 3:24 AM
Subject: [Ipsec] ipsec packet passage through IPSEC and FIREWALL enabledrouter

  Hi,

Thanks in advance,

Regards
mcreddy

------------------------------------------------------------------------------