Subject: [IPsec] Closing Issue #146 - Encapsulation wording

From: Yoav Nir <[email-masked]>
Date: Thu, 28 Jan 2010 14:51:03 +0200

Hi all

The "offending" paragraph is the following;

   An initiator can use port 4500, regardless whether or not there is
   NAT, even at the beginning of IKE.  When either side is using port
   4500, sending with UDP encapsulation is not required, but
   understanding received packets with UDP encapsulation is required.
   UDP encapsulation MUST NOT be done on port 500.  If NAT-T is
   supported (that is, if NAT_DETECTION_*_IP payloads were exchanged
   during IKE_SA_INIT), all devices MUST be able to receive and process
   both UDP encapsulated and non-UDP encapsulated packets at any time.
   Either side can decide whether or not to use UDP encapsulation
   irrespective of the choice made by the other side.  However, if a NAT
   is detected, both devices MUST send UDP encapsulated packets.

If we change it as follows, would that be OK?

   An initiator can use port 4500 for both IKE and ESP, regardless of
   whether or not there is NAT, even at the beginning of IKE.  When
   either side is using port 4500, sending with UDP encapsulation is
   not required, but understanding received IKE and ESP packets with
   UDP encapsulation is required. UDP encapsulation MUST NOT be done
   on port 500.  If NAT-T is supported (that is, if NAT_DETECTION_*_IP
   payloads were exchanged during IKE_SA_INIT), all devices MUST be able
   to receive and process both UDP encapsulated and non-UDP encapsulated
   packets at any time. Either side can decide whether or not to use UDP
   encapsulation irrespective of the choice made by the other side.
   However, if a NAT is detected, both devices MUST send UDP encapsulated
   packets.

I think this clarifies that we're talking about both IKE and IPsec.

Yoav