RE: Is TS agreement necessary?

["Wang, Cliff" <CWang@smartpipes.com>]

I don't understand the recursive part from both implementation and standards
point.

The SPD is used to decide what should go into the tunnel, normally a clear
packet, not an IPsec packet. When a clear packet is IPsec processed, it
carries protocol number 50 or 51. I think any sane SPD imlementation won't
let this packet to loop back to IPsec again, but instead pass it out.

Just trying to understand this recursive issue, which I fail to observe in
the existing IPsec implementations. 

-----Original Message-----
From: Joe Touch [mailto:touch@ISI.EDU] 
Sent: Thursday, April 11, 2002 4:43 PM
To: Mark Duffy
Cc: Lars Eggert; Stephen Kent; kalyan@juniper.net; ipsec mailling list
Subject: Re: Is TS agreement necessary?

[text deleted]
As per other mail to PPVPN, the issue is that the SA of the tunnel 
appears in the SPD of the tunnel itself. That seems recursive. It seems 
that the SA of a tunnel should appear in the SPD of the interface (real 
or virtual) that the tunneled packet will be emitted on.