[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: ingress filteing problem
Spencer Dawkins wrote:
> I'm probably late to the party, but don't (1) and (2) break
> transport-mode IPsec?
(1) depicts schemes to forward IP packet to the "correct" ISP such that the
source address is matching ISP's ingress filter. There is no IP src/dst
rewriting during the process. So, transport-mode IPsec won't be affected.
(2) use NAT to rewrite the locators (IP src/dst) in order to pass through
ISP's ingress filter and provides consistent src/dst address pair for
non-multi6 host at another end of the communication. It is no better (or
worse) than existing NAT deployments regarding IPsec compatibility issues.
> So IPsec transport mode would be a non-goal?
I can't speak for the WG. But I believe one of the goal is not to introduce
This is quote from "Goals for IPv6 Site-Multihoming Architectures (RFC
4. Security Considerations
A multihomed site should not be more vulnerable to security breaches
than a traditionally IPv4-multihomed site.
Any changes to routing practices made to accommodate multihomed sites
should not cause non-multihomed sites to become more vulnerable to