Subject: [Ipsec] L2TP/ IPsec

From: "Vishwas Manral" <[email-masked]>
Date: Mon, 17 Oct 2005 02:49:39 -0700

Hi,

RFC3193, "Securing L2TP using IPsec" states that "Transport mode MUST be
supported; tunnel mode MAY be supported".

However 2401bis states that 
  "When security is
   desired between two intermediate systems along a path (vs. end-to-end
   use of IPsec), transport mode MAY be used between security gateways
   or between a security gateway and a host."

Should we actually make changes in RFC3193 for L2TP/IPsec support to
make Transport mode a MUST and Tunnel mode a MAY?

Thanks,
Vishwas

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Mon, 17 Oct 2005 14:28:01 +0300

> supported; tunnel mode MAY be supported".

If I have understood correctly L2TP usage with IPsec then from the
IPsec point of view the L2TP traffic originates and terminates from
the IPsec node, i.e. it is not forwarded traffic. That is the reason
why transport mode is used there. In the receiving end the IPsec
decapsulation is done and then the packet is forwarded to the
local application, that will then do the L2TP decapsulation and then
send new (in a sense of IPsec) packet forward. 

> make Transport mode a MUST and Tunnel mode a MAY?

I think the use of transport mode in the host to host application
specific use is ok, even when the application happens to be L2TP which
will then send/receive packets forward. I think the key issue is that
L2TP packet is not same IP packet than what is decapsulated from
inside of it.
-- 
[email-masked]

---

From: Joe Touch <[email-masked]>
Date: Thu, 27 Oct 2005 13:35:52 -0700

Tero Kivinen wrote:
> the IPsec node, i.e. it is not forwarded traffic.

That is true for all tunnels where the tunnel is created by a separate
mechanism (e.g., RFC-3884). In those cases, it can be argued that the
router is acting as a host (packet source/sink) for tunneled traffic.

> That is the reason
> why transport mode is used there. 

There are a few reasons why the difference is important, in particular
in decoupling key selection from next-hop routing, where next-hop is
determined by the tunnel endpoint.

> In the receiving end the IPsec

I agree. However, the issue about MAY vs. MUST focuses on whether L2TP
focuses on 2401 or 2401bis, as noted in a later post.

Joe