Subject: Re: [Ipsec] Multicast Traffic support within IPSec VPN Tunnel?

From: "Shekhar Kshirsagar" <[email-masked]>
Date: Wed, 17 Nov 2004 16:27:37 -0800

With GRE, there is a need for point to point IPSec SAs. 
MSEC is about setting up group keys, so that overhead of point to point SAs can be avoided.

Shekhar

>>> Michael Reilly <[email-masked]> 11/17/04 03:42PM >>>
Using GRE is a common way to do this now.  Setup a GRE tunnel and protect it 
using IPSec.

michael

Stephen Kent wrote:
> At 9:31 AM +0530 10/12/04, Madhukesh Jayadevaiah wrote:
> 
>> Hi,
>>
>> Can IPSec VPN Site-to-Site tunnel carry Multicast traffic or Broadcast
>> traffic with in the tunnel?
>>
>> If yes, is it just the bare IPSec protocol which can allow Multicast
>> or Broadcast traffic to pass through the tunnel or do GRE or any such
>> protocol is mandatory?
>>
>> If No, why IPSec by itself can not carry Multicast or Broadcast
>> traffic through the tunnel?
>>
>> Looking forward for reply.
>>
>> Thanks and Regards,
>> Madhukesh.
> 
> 
> if you need only to move the multi-cast or broadcast traffic between two 
> IPsec implementations, then yes, this is simple and does not require 
> special, multi-cast support from IPsec. Under 2401 you could use IPsec 
> tunnel mode and just specify the addresses in the SPD to encompass the 
> multi-cast or broadcast traffic addresses.  Under 2401bis you also could 
> use transport mode on a point-to-point basis, with IP-in-IP tunneling.
> 
> However, if what you want if for IPsec to carry the multicast traffic 
> and deliver it to multiple destinations, then that requires use of the 
> features being developed in the MSEC WG and you should see their RFCs on 
> how to enhance IPsec for that sort of multi-cast support.
> 
> Steve
> 
> _______________________________________________
> Ipsec mailing list
> [email-masked] 
> https://www1.ietf.org/mailman/listinfo/ipsec 

-- 
---- ---- ----
Michael Reilly    [email-masked] 
     Cisco Systems,  California

_______________________________________________
Ipsec mailing list
[email-masked] 
https://www1.ietf.org/mailman/listinfo/ipsec 

________________________________________________________________________
This email has been scanned for computer viruses.

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Michael Reilly <[email-masked]>
Date: Wed, 17 Nov 2004 16:51:53 -0800

Which is why I said "now".  When MSEC is deployed that will be the preferred 
way to deal with multicast.  But that doesn't change the fact that GRE is 
the common way to do it now.

michael