Subject: Re: [Ipsec] IPsec 2401bis -- new draft

From: Mark Duffy <[email-masked]>
Date: Tue, 02 Nov 2004 18:41:39 -0500

At 03:57 AM 10/25/2004, Karen Seo wrote:
[snip]
>35. Mark Duffy
>
>Remove some inconsistencies re: fragmenting outbound packets
>
>   5.1 Outbound IP Traffic Processing (protected-to-unprotected) --
>   deleted the following NOTE after step 4
>
>         NOTE: With the exception of IPv4 and IPv6 transport mode,
>         an SG, BITS, or BITW implementation MAY fragment packets
>         before applying IPsec. The device SHOULD have a configuration
>         setting to disable this.  The resulting fragments are
>         evaluated against the SPD in the normal manner.  Thus,
>         fragments not containing port numbers (or ICMP message type
>         and code, or Mobility Header type) will match rules only
>         having port (or ICMP message type and code, or MH type)
>         selectors of OPAQUE or ANY. (See section 7 for more details.)

Although this change is attributed to a request from me, I don't believe I 
asked for it.  Was there any other reason to remove it?

I think this statement should remain in the document.  As far as I can see 
this is not stated explicitly anywhere else, except the "13. Differences 
from RFC 2401" which says on p.63:

    o For tunnel mode SAs, an SG, BITS, or BITW implementation is now
       allowed to fragment packets before applying IPsec.  This applies
       only to IPv4.  For IPv6 packets, only the originator is allowed to
       fragment them.

--Mark

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec