Subject: Re: [Ipsec] Multicast Traffic support within IPSec VPN Tunnel?

From: Stephen Kent <[email-masked]>
Date: Wed, 17 Nov 2004 18:13:18 -0500

At 9:31 AM +0530 10/12/04, Madhukesh Jayadevaiah wrote:
>Hi,
>
>Can IPSec VPN Site-to-Site tunnel carry Multicast traffic or Broadcast
>traffic with in the tunnel?
>
>If yes, is it just the bare IPSec protocol which can allow Multicast
>or Broadcast traffic to pass through the tunnel or do GRE or any such
>protocol is mandatory?
>
>If No, why IPSec by itself can not carry Multicast or Broadcast
>traffic through the tunnel?
>
>Looking forward for reply.
>
>Thanks and Regards,
>Madhukesh.

if you need only to move the multi-cast or broadcast traffic between 
two IPsec implementations, then yes, this is simple and does not 
require special, multi-cast support from IPsec. Under 2401 you could 
use IPsec tunnel mode and just specify the addresses in the SPD to 
encompass the multi-cast or broadcast traffic addresses.  Under 
2401bis you also could use transport mode on a point-to-point basis, 
with IP-in-IP tunneling.

However, if what you want if for IPsec to carry the multicast traffic 
and deliver it to multiple destinations, then that requires use of 
the features being developed in the MSEC WG and you should see their 
RFCs on how to enhance IPsec for that sort of multi-cast support.

Steve

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Michael Reilly <[email-masked]>
Date: Wed, 17 Nov 2004 15:42:10 -0800

Using GRE is a common way to do this now.  Setup a GRE tunnel and protect it 
using IPSec.

michael

Stephen Kent wrote:
> if you need only to move the multi-cast or broadcast traffic between two 
> IPsec implementations, then yes, this is simple and does not require 
> special, multi-cast support from IPsec. Under 2401 you could use IPsec 
> tunnel mode and just specify the addresses in the SPD to encompass the 
> multi-cast or broadcast traffic addresses.  Under 2401bis you also could 
> use transport mode on a point-to-point basis, with IP-in-IP tunneling.
> 
> and deliver it to multiple destinations, then that requires use of the 
> features being developed in the MSEC WG and you should see their RFCs on 
> how to enhance IPsec for that sort of multi-cast support.
> 
> Steve
> 

-- 
---- ---- ----
Michael Reilly    [email-masked]
     Cisco Systems,  California

---

From: Stephen Kent <[email-masked]>
Date: Thu, 18 Nov 2004 11:55:27 -0500

At 3:42 PM -0800 11/17/04, Michael Reilly wrote:
>Using GRE is a common way to do this now.  Setup a GRE tunnel and 
>protect it using IPSec.
>
>michael
>

Yes, one can do that, but of course the extra layer (GRE) looses the 
IPsec access control functionality for the multicast traffic. If the 
intent is a point-to-point tunnel in an overlay net context, then 
this is not an issue.

Steve