Re: Remove tunnel mode from ipsec-tunnels-02?

[Pekka Savola <pekkas@netcore.fi>]

On Wed, 6 Sep 2006, Fred Baker wrote:
> given that there are significant networks that operate in tunnel mode, 
> including both corporate VPNs and military networks that use tunnel mode 
> between encryption devices with a specific view to hiding interior addressing 
> and therefore military asset distribution from prying eyes, this proposal 
> seem profoundly silly.

Our assumption has been that transport mode is applied to a tunnel 
interface (such as IPv6-in-IPv4, GRE etc).  That hides the inner 
addresses from those observers that would have been on-path in the 
tunnel.

When IPsec tunnel mode is _NOT_ modelled as an interface, then this is 
OK though IMHO suboptimal because you cannot in practice run neighbor 
discovery, routing protocols, multicast etc. over such tunnels.  Due 
to the link-local issues mentioned previously, tunnel mode is not 
something we can recommend when it's modelled as an interface.

If there is something you disagree with in the above two paragraphs, 
maybe you should clarify what the deployment looks like, because there 
are a lot of different variations how IPsec could be applied:

 a) transport mode in host-to-host mode (end-to-end IPsec)
 b) transport mode when applied to an IP tunnel interface (e.g., 
between security gateways or a security gateway and a node)
 c) tunnel mode, not modelled as an interface
 d) tunnel mode, modelled as an interface

a) is out of scope of this document. b) seems best option by far.  c) 
can also work but has more more limited applicability as routing 
protocols, multicast, etc. don't work.  There is no interoperable 
standards solution for d) that wouldn't break IPv6 architecture hence 
it's non-starter.

> Maybe you could remind us why the v6ops working group is supposed to be 
> overriding the recommendation of the ipsec working group on how security is 
> supposed to work based on what is convenient to IPv6?

I don't see what's being overridden.  IPsec architecture allows the 
use of transport mode between a node and a security gateway.  If the 
use of tunnel mode is suboptimal, I don't see it as a problem to 
recommend another approach instead.

--
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings