Re: Specification of tunnel/transport attribute in IKEv2

[Markku Savela <msa@burp.tkv.asdf.org>]

> Also, we decided that the ordering of the protocols in the proposal
> shouldn't matter, since the only ordering that makes sense is
> [AH][ESP]

But, if I do *WANT* to do [ESP][AH]? Basicly, I want to check IP
headers, but not wanting the sniffers to know that I'm checking...

...and if someone wonders what is checked: if I have

  [IP-hdrs][ESP][AH]...

then first ESP gets applied and removed resulting

  [IP-hdrs][AH]...

and then AH checks the IP-hdrs.

(and yes, the IPSEC I wrote can do this, if IKE wouldn't object.. :-)