Re: a simple question, I hope. Why do we need tunnel mode?

[Stephen Kent <kent@bbn.com>]

Steve,

If an SA is tunnel mode, it has an interior IP header which is checked
against the selectors associated with that SA, whereas the outer IP header
is discarded. If an SA is transport mode, the outer IP header is checked
against these selectors and is not discarded.  Thus the two modes impose
different processing requirements on received traffic. It is a security
requirement that a receiver be able top tell what processing is expected of
each packet received on an SA. If one transports other than IP in an IPsec
environment, there is still a requirement to use tunnel mode and to have an
inner IP header, above which one might employ a GRE header to encapsulate
the foreign protocol.  We have not specified how non-IP traffic is to be
handled, but what I described would be consistent with the architectrure as
it stands.

Steve

---

References:

• a simple question, I hope. Why do we need tunnel mode?
• From: Stephen Waters <Stephen.Waters@digital.com>

---

• Prev by Date: Re: Last Call for IPSEC
• Next by Date: FW: Key Recovery
• Prev by thread: Re: a simple question, I hope. Why do we need tunnel mode?
• Next by thread: Re: a simple question, I hope. Why do we need tunnel mode?
• Index(es):
  • Main
  • Thread