Subject: [Ipsec] question about nested tunnelling and inbound

From: "mahdavi" <[email-masked]>
Date: Tue, 29 Mar 2005 19:29:03 +0330

Hi dear experts. 

(according to rfc2401 not rfc2401bis ) ( Rfc2401 part 5.2.1  "Do (1) and (2)
for every IPsec header until a Transport Protocol Header or an IP header that
is NOT for this system is encountered.  Keep track of what SAs have been used
and their order of application." ) 

        ROUTER----- Security ---- Internet -- Security --- Host 2
         | |         Gwy 1                      Gwy 2         |
         | |                                     |            |
         | ----Security Association 1 (tunnel)----            |
         |                                                    |
          ---------Security Association 2 (tunnel)-------------

For Inbound process for above router, does above sentence means that we MUST
check SPD for all tunnels at once (after all SA's applied for decapsulating)
at the end of processing OR 
can we check SPD after decapsuling each tunnels ?  

regards 
mahdavi.

<-:->

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Stephen Kent <[email-masked]>
Date: Tue, 29 Mar 2005 11:52:35 -0500

>can we check SPD after decapsuling each tunnels ? 

check each header against the SPD after each decapsulation is performed.

Steve