Subject: RE: [Ipsec] L2TP/ IPsec

From: "Vishwas Manral" <[email-masked]>
Date: Mon, 17 Oct 2005 05:29:21 -0700

Hi Tero,

Thanks a lot for the reply. I agree with your reply that the packet is
as if it is terminating/ originating at the gateway. 

Further quoting the 2401bis: -

      Where traffic is destined for a security gateway, e.g., SNMP
      commands, the security gateway is acting as a host and transport
      mode is allowed. 

The above seems to mean that the condition in such a case is a MAY
condition not a MUST. The MAY vs. a MUST is my main concern. I agree the
L2TP/ IPsec RFC refers to 2401 and not 2401bis.

Thanks again,
Vishwas
-----Original Message-----
From: Tero Kivinen [mailto:[email-masked]] 
Sent: Monday, October 17, 2005 4:58 PM
To: Vishwas Manral
Cc: [email-masked]
Subject: [Ipsec] L2TP/ IPsec

Vishwas Manral writes:
> RFC3193, "Securing L2TP using IPsec" states that "Transport mode MUST
be
> supported; tunnel mode MAY be supported".

If I have understood correctly L2TP usage with IPsec then from the
IPsec point of view the L2TP traffic originates and terminates from
the IPsec node, i.e. it is not forwarded traffic. That is the reason
why transport mode is used there. In the receiving end the IPsec
decapsulation is done and then the packet is forwarded to the
local application, that will then do the L2TP decapsulation and then
send new (in a sense of IPsec) packet forward. 

> However 2401bis states that 
>   "When security is
>    desired between two intermediate systems along a path (vs.
end-to-end
>    use of IPsec), transport mode MAY be used between security gateways
>    or between a security gateway and a host."
> 
> Should we actually make changes in RFC3193 for L2TP/IPsec support to
> make Transport mode a MUST and Tunnel mode a MAY?

I think the use of transport mode in the host to host application
specific use is ok, even when the application happens to be L2TP which
will then send/receive packets forward. I think the key issue is that
L2TP packet is not same IP packet than what is decapsulated from
inside of it.
-- 
[email-masked]

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec