[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: ESP and AH used in tunnel mode by a Security Gateway
Ben,
>I'm guessing that since the encapsulation mode attribute is optional,
>the wildcard would be the absence of this attribute. I think that it
>is a valuable thing to do on a Security Gateway which can also act as
>a Host implementation. That way, communication between hosts behind
>the SG to the remote end is in tunnel mode and between the SG and the
>remote end is in transport mode. This is the most efficient way to
>handle bandwidth in this case, since an unnecessary IP header is not
>added.
The Arch Doc states that the wildcard value in the SAD is applicable to
host implemnetations and reiterates that gateways must use tunnel mode.
(See section 4.4.3, pages 24-25, latest I-D.) Thus, the discussion of this
wildcard feature does not apply to the security gateway SA mode discussion
you're having here.
Steve
Follow-Ups:
References: