[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Remove tunnel mode from ipsec-tunnels-02?
I reordered the response to get the most important bits first. As I
suspected, we've been in full agreement about the issue all along, but
have disagreed about what "tunnel mode" means,
On Sun, 10 Sep 2006, Fred Baker wrote:
As RFC 4303 uses the terms, I don't think you can support the claim that
Transport Mode can be implemented by positioning an interior IP header. It
may be that the thing that you are trying to excise is in fact that usage -
transport mode being applied between tunnel endpoints around other kinds of
In any event, I don't expect people to stop using L2TP to provide a tunnel
service, or GRE as a way to overlay CE-CE VPNs.
I don't expect either, which is why we're describing how to protect
such tunnels with IPsec using transport mode. That's actually why GRE
and L2TP specifications either mandate supporting transport mode
(while tunnel mode is a MAY) or specify that transport mode SHOULD be
used. See e.g. RFC4023 section 8.1 and RFC 3193.
And the rest, if it's still relevant,
I think we're in full agreement about the fundamental issue: there should
be an inner IP header that's protected by IPsec. The point is that it can
be provided either by transport or tunnel mode, and based on our analysis
'tunnel mode' is a more constrained way of making such a tunnel and
therefore less preferred.
I would encourage you to not look at presentations, but at the controlling
specifications, for the use of the term. Specifically I'm thinking about RFC
4303, which very explicitly defines tunnel mode as having an interior IP
header (section 3.1.2) and transport mode as proceeding end to end without
using an interior header (section 3.1.1).
That misses the point. Transport mode is applied "end to end" but the
endpoints of a transport mode-protected tunnel are the tunnel
endpoints so it is in end-to-end (with encapsulator/decapsulator being
the endpoints). Also, while one could correctly say "The next-header
of an IPsec ESP header is an interior IP header if the IPsec SA is
tunnel mode" you cannot substitute "if" with "if and only if".
Pekka Savola "You each name yourselves king, yet the
Netcore Oy kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings