Re: Fwd: IPsec issue #50 -- tunnel vs transport mode at link layer

[Joe Touch <touch@ISI.EDU>]

Stephen Kent wrote:

>> ...
>>
>>>  I think that the model we should be using, which is less restrictive
>>>  than what 2401 says, is that a user of IPsec can perform tunneling
>>>  before invoking IPsec, if the application context warrants, and in that
>>>  case IPsec can be used in transport mode and will enforce access
>>>  controls based only on the external header. consistent with the
>>>  provision of link security.
>>
>> Transport mode checks the internal transport header. When a tunneled 
>> packet uses transport mode, the inner packet is an IP header, and 
>> should be checked as well.
> 
> For outbound traffic there is no difference between the header examined 
> by transport or tunnel mode in IPsec. But for inbound traffic, transport 
> and tunnel mode examine different headers. That is the essence of the 
> difference between the two modes. Please do not redefine what transport 
> mode does today to match what you want it to do in the future.

_Tunneling_ (encaps/decaps) is the "essence of the difference".

Which headers are checked, or whether such is part of IPsec or a 
separate firewall service, or whether such is applied consistently 
within IPsec, is certainly an artifact of what is done today.

Redefining what is done today is the "essence of the difference" that 
warrants revision of 2401.

Transport mode ignores all but two (coming to be three) specific 
Internet transport protocols. It will be incomplete until it handles the 
remainder.

Joe