Subject: Re: IPCOMP and IPSEC

From: Daniel Harkins <[email-masked]>
Date: Thu, 28 May 1998 09:52:50 -0700

Roy,

> IPComp may be added by a security gateway just like IPSec ESP/AH is
> added.  It would probably look like this though:
> 
> [IP2]
>   [ESP spi+replay+iv]
>     [IP1]
>     [IPCOMP]
>       [TCP]
>       [data] 
>     [ESP padding+next protocol+auth]

  Why would it look like that and not:

  [IP2]
    [ESP spi+replay+iv]
      [IPCOMP]
        [IP1]
        [TCP]
        [data] 
      [ESP padding+next protocol+auth]

  I have a rule that says "for traffic from foo to bar apply IPCOMP then
IPSec" so why would my IPCOMP be effectively a transport mode application
while my IPSec would be tunnel. They're both part of the same rule so
they're both done in the same mode.

  An intermediate gateway shouldn't muck with the inner packet. If you
did what you propose the packet would be forwarded on to the destination
address of IP1 who most likely doesn't have the IPCOMP SA to decompress
it.  The IPCOMP "SA" is negotiated along with the IPSec SA so they both 
have to be targeted to the same destination and be applied in the same mode. 

  Dan.

---

From: Roy Pereira <[email-masked]>
Date: Thu, 28 May 1998 12:25:17 -0400

[IP2]
  [ESP spi+replay+iv]
    [IP1]
    [IPCOMP]
      [TCP]
      [data] 

> -----Original Message-----
> From: Stephen Waters [mailto:[email-masked]]
> Sent: Wednesday, May 27, 1998 6:19 PM
> To: [email-masked]; [email-masked]
> Subject: IPCOMP and IPSEC
> 
> 
> 
> Is IPCOMP restricted for use by Hosts (at packet origin), or can it be
> appended by a Security Gateway as part of the process of 
> adding an IPSEC
> tunnel header?
> 
> e.g.
> 
> Original host packet [IP1][TCP][data]
> 
> After passing through a security gateway/IP tunnel:
> 
> [IP2][ESP][IPCOMP][IP1][TCP][data][padding/next protocol][ESP auth]
> 
> 
> If this is supported, is it detailed anywhere?  For example, if an
> Explicit IV is used, would it come after the ESP header or after the
> IPCOMP header?
> 
> 
> 
> 
> 
> Stephen Waters
> DEVON, UK
> 
> National: 01548 551012 / 550474
> International: 44 1548 551012 / 550474
> [email-masked] 
>