Subject: RE: [Ipsec] FW: Multicast - IPsec in Tunnel mode

From: "H.Cruickshank" <[email-masked]>
Date: Tue, 16 Aug 2005 14:55:52 +0100

Hi George,

Many thanks for your reply.  I am aware of the msec draft on multicast
extension (draft-ietf-msec-ipsec-extensions-00.txt).  However my
question was about the current IPsec (standard) and how does the tunnel
mode work with multicast.

Haitham

--

Dr. Haitham S. Cruickshank 

Lecturer

Communications Centre for Communication Systems Research (CCSR) 

School of Electronics, Computing and Mathematics 

University of Surrey, Guildford, Surrey GU2 7XH, UK 

Tel: +44 1483 686007 (indirect 689844) 

Fax: +44 1483 686011 

e-mail: [email-masked] 

http://www.ee.surrey.ac.uk/Personal/H.Cruickshank/ 

-----Original Message-----
From: George Gross [mailto:[email-masked]] 
Sent: 16 August 2005 10:56
To: Cruickshank HS Dr (CCSR)
Cc: ipsec
Subject: Re: [Ipsec] FW: Multicast - IPsec in Tunnel mode

Hi Haitham,

You can find a discussion of IPsec tunnel mode, and many other aspects
of IPsec secure multicast in the draft:

http://www.ietf.org/internet-drafts/draft-ietf-msec-ipsec-extensions-00.
txt

wrt/ your two questions, the above draft defines an optional flag for
use in combination with the Populate From Packet (PFP) mode SPD entries
that enhances IPsec tunnel mode for secure multicast. Plz refer to the
draft section 3 for the details....

hth,
	George

On Tue, 16 Aug 2005, H.Cruickshank wrote:

>
> -----Original Message-----
> From: Cruickshank HS Dr (CCSR)
> Sent: 16 August 2005 08:56
> To: [email-masked]'; [email-masked]
> Subject: Multicast - IPsec in Tunnel mode
>
>
> Hi,
>
> I wonder if somebody can help me to understand how  does IPsec (tunnel
> mode) work with multicast:
>
> Scenario 1:
> -----------
> There is an IP multicast session in the clear.  Part of the multicast 
> distribution paths are controlled by security gateways, where they 
> MUST use IPsec in tunnel-mode between them.  Let us assume that there 
> are 4 security gateways: How does IPsec (tunnel mode) work here.
>
>
> Scenario 2:
> -----------
> Same as scenario 1, except that the original IP multicast session is 
> secure (e.g. IPsec in transport mode between sender and receivers) .  
> So how does the security gateways use IPsec in tunnel-mode now.
>
> Many thanks.
> Haitham
>
>

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: George Gross <[email-masked]>
Date: Tue, 16 Aug 2005 07:27:27 -0400 (EDT)

Hi Haitham,

inline below....

> mode work with multicast.

I can understand your confusion, perhaps I can clarify the relationship
between the draft-ietf-msec-ipsec-extensions-00.txt and other IPsec
documents.

In the original RFC2401, the definition of secure multicast processing was
not altogether as well understood as compared to what is known now.
Consequently, folks in MSEC worked with Steve Kent to formulate a more
mature secure multicast definition for inclusion in RFC2401-bis. I don't
know off hand if any document explicitly says this, but the intent is that
the use of secure multicast with RFC2401 implementations is deprecated.

In RFC2401-bis, support for secure multicast is optional. For those
RFC2401-bis compliant IPsec implementations that choose to support secure
multicast, the msec-ipsec-extensions draft adds additional mandatory
requirements beyond those stated in RFC2401-bis. These requirements mostly
concern tunnel mode SAs. RFC2401-bis and its companions are currently in
the RFC editor's queue. The msec-ipsec-extensions draft is standards track
work item within the MSEC working group.

does that help clarify the IPsec document relationships?

br,
	George