[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: comments on VPN framework document
Stephen,
>The VPN framework lists some of the problems, but my main problem with a
>plain 'IPSEC-tunnel' is that it is not a tunnel at all, really - just a
>security encapsulation scheme. If you encrypt the original IP header, what
>alternative have you got but to add another one.
A tunnel, in th IP context, entails point-to-point encapsulation of traffic
with an external IP header, designed to carry the traffic to a
decapsulation point to which the traffic would not otherwise be routed.
IPsec tunneling fits this definition, as does IP-in-IP and IPX-over-IP,
etc.
IPsec, because it has been designed for use with IP imposes certain
processing on the content of tunnel mode traffic, specifically because
IPsec is not just an encryption facility. It (usually) provides
authentication and optional anti-replay, and embodies a simple form of
access control. In tunnel mode, the headers use for access control are
those encapsulated by IPsec, vs. use of the outer headers in transport mode.
Steve
References: