divergent interpretations of IKE/IPsec - interop issues

[Christophe Gouault <christophe.gouault@6wind.com>]

Hello,

During interoperability tests on several IKE/IPsec implementations, we
discovered different interpretations of the IKEv1 or IPsec
specification.

Let's consider the following transform:

(1)       [IP][data]  ==(IPsec)==>  [IP][AH][ESP][encrypted IP+data]

To negociate such transform as IKE-initiator,
(2) some implementations send a QM proposal of AH_transport + ESP_tunnel
    (6WIND, KAME, OpenBSD...)
(3) some other implementations send a QM proposal of AH_tunnel +
    ESP_tunnel (FreeS/WAN, Cisco...)

If initiator and responder use different interpretations, the
negociation fails most of the time.
These two different interpretations consequently lead to
non-interoperable implementations.

IMHO only ESP is in tunnel mode in this transform, as opposed to AH
which is in transport mode. But some implementors seem to consider that
mode applies globally to the transform (AH+ESP).

Are (2) and (3) valid representations of transform (1) ?

/christophe