Subject: [IPsec] Issue #136: NAT traversal and transport mode

From: Paul Hoffman <[email-masked]>
Date: Sun, 17 Jan 2010 08:08:00 -0800

In section 2.23 the word "float" needs to be replaced:

   An initiator can use port 4500, regardless whether or not there
   is NAT, even at the beginning of IKE.  When either side is using port

In section 2.23 the paragraph:

   o  The original source and destination IP address required for the
      transport mode TCP and UDP packet checksum fixup (see [UDPENCAPS])
      are obtained from the Traffic Selectors associated with the
      exchange.  In the case of NAT traversal, the Traffic Selectors
      MUST contain exactly one IP address, which is then used as the
      original IP address.

Says that In case of NAT traversal there MUST only be exactly one IP
address, but that actually only covers the transport mode NAT-Traversal
(as said in the beginning of paragraph) so the text should be changed to:
      
   o  The original source and destination IP address required for the
      transport mode TCP and UDP packet checksum fixup (see [UDPENCAPS])
      are obtained from the Traffic Selectors associated with the
      exchange.  In the case of transport mode NAT traversal, the Traffic
      Selectors MUST contain exactly one IP address, which is then used
      as the original IP address.

--Paul Hoffman, Director
--VPN Consortium