[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: ICMP Security Failures
>> Note that in "transport-mode", the SPI indicated will be of the outer
>I think I get it, but I'm not familiar with the term "transport-mode".
I'd like to expunge use of the terms "transport-mode" and
"tunnel-mode" from IPSEC documents. Not because the modes they
describe aren't useful, but because I really consider them completely
orthogonal to the security mechanisms IPSEC provides.
"Tunnel mode" simply implies that a host has the ability to tunnel and
detunnel packets, irrespective of whether that host also implements
IPSEC (AH and ESP). It simply means that the host implements IP
Protocol No. 4. If the host also happens to implement IP Protocols
Nos. 50 and 51 (IP Security), it's free to combine all three in any
fashion it chooses. But the mechanisms of IP security are completely
independent of whether the payload is a UDP or TCP segment or another
IP datagram.
Phil
References: