[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: tunnle mode SAs...
At 5:11 PM +0000 4/24/01, Jain, Gautam wrote:
>With reference to section 4.1 in RFC 2401 I have a question on the
>following statement.
>
>The requirement for any (transit traffic) SA involving a
>security gateway to be a tunnel SA arises due to the need to avoid
>potential problems with regard to fragmentation and reassembly of
>IPsec packets, and in circumstances where multiple paths (e.g., via
>different security gateways) exist to the same destination behind the
>security gateways.
>
>How does a tunnel mode SA avoid the fragmentation problem and why
>is a transport mode SA a problem if there exist multiple paths to the
>same destination behind the security gateways ?
In tunnel mode packets are addressed to a single target SG, thus
ensuring that all fragments arrive at one point, where they can be
reassembled. In transport mode, the address of the ultimate target,
not the SG, would allow traffic, including fragments, on one SA to be
routed to different SGs, and this would preclude reassembly at an
intermediate SG.
Steve
References: