[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Bruce Schneier on IPsec

On Tue, 1 Feb 2000, Bill Sommerfeld wrote:
> [is tunnel mode superfluous?]
> Now, if all of your interfaces (including your tunnels) are set up
> with appropriate inbound filters, this isn't a big deal, but
> traditionally, that sort of filtering is not part of an IP stack.

It may not be traditional, but it is increasingly common in the real
world.  And the sysadmins are not going to want to deal with two separate
filtering mechanisms, one inside IPSec and one for everything else.

> Always having the inner ip header (making the outer ip header
> irrelevant) would allow the check to always be done as part of ipsec
> rather than over in some other part of the system.

And this is important why?

                                                          Henry Spencer
                                                       henry@spsystems.net
Follow-Ups: References: