Subject: [IPsec] NAT-T and IPv6

From: Gandhar Gokhale <[email-masked]>
Date: Fri, 22 Nov 2013 19:34:53 +0530

Hello,

RFC3948 states in the Introduction section:

“As defined in this document, UDP encapsulation of ESP packets is  written
in terms of IPv4 headers.  There is no technical reason why an IPv6 header
could not be used as the outer header and/or as the inner header.

And in section 2.1 it states

"o  the IPv4 UDP Checksum SHOULD be transmitted as a zero value, and

 o  receivers MUST NOT depend on the UDP checksum being a zero value"

As per RFC 2460 UDP header with 0 checksum must be discarded.

If all these statements are seen together it would mean NAT-T for IPv6 as
described in RFC 3498 won't work.

Am I missing something?

Is NAT-T a valid deployment case for IPv6 network i.e. when the outer
header of IPsec tunnel is IPv6?

-- 
Gandhar Gokhale
Networking Components Group
LSI

---

From: Tero Kivinen <[email-masked]>
Date: Mon, 25 Nov 2013 17:20:22 +0200

Gandhar Gokhale writes:
> As defined in this document, UDP encapsulation of ESP packets is 
> written in terms of IPv4 headers.  There is no technical reason why
> an IPv6 header could not be used as the outer header and/or as the
> inner header.

Of course we hope nobody every makes NATs for IPv6, but having IPv4
NAT and then having IPv6 packets inside is of course possibility. 

>  o  receivers MUST NOT depend on the UDP checksum being a zero value"

Note that it only talks about IPv4 UDP Checksum field, it does not
specify such recommendation for IPv6 UDP checksum.

> As per RFC 2460 UDP header with 0 checksum must be discarded.  

Which is why the with the IPv6 you must calculate UDP checksum when
sending the packet. Using the IPv4 UDP checksum of 0 is an
optimization, which removes useless checksum calculations of the UDP
packet, and that optimization cannot be used for IPv6. 

> described in RFC 3498 won't work. 

I think you are missing the "IPv4" word in the quoted context. It does
not claim you can use that optimization for IPv6. For IPv6 you must
calculate checksum properly when sending UDP encapsulated ESP packets
over IPv6.

For more information check the RFC3715 which have bit more text about
IPv6 and NATs, and if I remember right there might have also been some
discussion about this in the IPsec mailing list during the development
of this rfc.

> Is NAT-T a valid deployment case for IPv6 network i.e. when the
> outer header of IPsec tunnel is IPv6?

Yes, but hopefully people will not do NATs on IPv6 :-)

There are use cases for static stateless NATs in the IPv6, i.e. prefix
changes and you do not want to renumber your whole network, but IPv4
style dynamic NATs should not be needed in IPv6.
-- 
[email-masked]

---

From: "Shravan Vuggrala (svuggral)" <[email-masked]>
Date: Tue, 26 Nov 2013 04:07:03 +0000

Its already mentioned in the first section that there is no technical reason why it should not work with IPv6.

<<

inner header.

—
Regards
Shravan

From: Gandhar Gokhale <[email-masked]<mailto:[email-masked]>>
Date: Friday, November 22, 2013 at 7:34 PM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: [IPsec] NAT-T and IPv6

Hello,

“As defined in this document, UDP encapsulation of ESP packets is  written in terms of IPv4 headers.  There is no technical reason why an IPv6 header could not be used as the outer header and/or as the inner header.

If all these statements are seen together it would mean NAT-T for IPv6 as described in RFC 3498 won't work.

Am I missing something?

Is NAT-T a valid deployment case for IPv6 network i.e. when the outer header of IPsec tunnel is IPv6?

---

From: "Shravan Vuggrala (svuggral)" <[email-masked]>
Date: Tue, 26 Nov 2013 04:18:12 +0000

Missed part of the email…

In IPv6 the checksum is replaced as 0xFFFF if the checksum yields ZERO and the responder ignores that.

--
Thanks

From: Shravan Vuggrala <[email-masked]<mailto:[email-masked]>>
Date: Tuesday, November 26, 2013 at 9:37 AM
To: Gandhar Gokhale <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [IPsec] NAT-T and IPv6

<<

inner header.

—
Regards
Shravan

Hello,

Am I missing something?

---

From: Gandhar Gokhale <[email-masked]>
Date: Tue, 26 Nov 2013 15:27:56 +0530

Thank you Tero. It clarifies my doubt.
However, with a SHOULD clause it's not quite apparent in the RFC that
this is just an 'optimization' for IPv4. And since the RFC claims that
there is no technical reason for this not to work with IPv6 it becomes
incompatible set of statements.
Now, seen in the light of optimization it makes sense to me. SHOULD
clause can be defied if there's a strong reason for it and
incompatibility of IPv6 is sufficiently strong reason to defy this
SHOULD, I suppose.

---

From: Tero Kivinen <[email-masked]>
Date: Tue, 26 Nov 2013 16:44:44 +0200

> incompatible set of statements.

I think the SHOULD clause is VERY clear that it only covers IPv4. The
"IPv4" text was added there in the -08 version of the
draft-ietf-ipsec-udp-encaps draft just because there was comment that
checksum cannot be zero on IPv6...

And NAT-T does work with IPv6, but some things are different with IPv4
and IPv6...

> incompatibility of IPv6 is sufficiently strong reason to defy this

There is nothing in the document saying how you should set checksum
field if you are using IPv6. There is SHOULD saying that "IPv4 UDP
Checksum" SHOULD be transmitted as zero. That SHOULD does not apply at
all, unless you are using IPv4.

Even if you are using this with IPv6, you can set the "IPv4 UDP
checksum" to zero, but of course "IPv6 UDP checksum" is completely
different thing, and that must be set, as defined in the IPv6
specifications.
-- 
[email-masked]