Subject: Re: [Ipsec] forward to transport mode

From: Francis Dupont <[email-masked]>
Date: Mon, 19 Sep 2005 17:49:04 +0200

In your previous mail you wrote:

   Especially in transport mode, IPsec is applied only to packets that
   *originate* from a node.

=> so you agree this is an essential property of the transport mode.

   Your scenario as describe is quite broken - any implementations that behave
   in such a manner are toxic, and should be smashed into little bits.

=> half bits (harder to repair :-)...

Thanks

[email-masked]

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Stephen Kent <[email-masked]>
Date: Mon, 19 Sep 2005 13:35:07 -0400

Francis,

I agree that the example you cite describes behavior that we do not 
want to take place.  As you noted, transport mode is to be applied to 
packets that originate from a node, as far as the packet's IP header 
indicates. If the packet was forwarded, as in an overlay net, the 
there has to be an inner IP header and the receiver needs to be aware 
that this sort of tunneling, external to Ipsec, is taking place.

When folks say that they don't see tunnel and transport modes as 
different enough to need to be labelled in the SAD, I think they are 
saying that they do not see a need to signal to a receiver this sort 
of fundamental distinction.  I disagree and your example shows why 
this can be a problem.

Steve