Subject: (IPng 7236) Re: Last Call: Mobility Support in IPv6 to Propos ed Standard

From: Richard Draves <[email-masked]>
Date: Tue, 23 Feb 1999 11:55:24 -0800

> >I don't understand how it can be legitimate for an 
> IPsec-enabled node that
> >is receiving a packet with a routing header to bypass inbound IPsec
> >processing.
> 
> There is no contradiction here if the node is not a party to an SA
> associated with the IPsec headers in the packet in question.  
> A security
> policy at an intermediate node could allow traffic to transit 
> without Ipsec
> processing, if it "appeared" that such processing had been 
> applied already.
> I'm not suggesting that this is good or bad, just making an 
> observation
> about what it means to implement IPsec at an SG vs. what it 
> implies for
> processing of transit traffic.  I don'ty necessarily think we're in
> disagreement here, but I didn't agree with your 
> characterization of the
> situation, in the cited paragraph.

Steve, perhaps Steve Deering is correct and my use of "IPsec processing" is
confusing.

Would you agree with this statement:

"An IPsec-enabled node that is processing a routing header must perform
inbound and outbound security policy checks, analogous to the checks
performed by security gateways."

If we are in agreement on this, then I'd like to move on to considering the
IPsec processing performed by a node generating a packet with a routing
header, with the case of a correspondent node sending a packet to a mobile
node being one example.

Thanks,
Rich
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Stephen Kent <[email-masked]>
Date: Wed, 24 Feb 1999 09:49:03 -0500

Richard,

>header, with the case of a correspondent node sending a packet to a mobile

The critical issue is whether the node is a party to an SA for the packet
and IPsec header in question.  The fact that this is not mentioned in your
concise statement makes me feel that we may still not be on the same
wavelength.

Steve

---

From: Erik Nordmark <[email-masked]>
Date: Wed, 24 Feb 1999 14:43:06 -0800 (PST)

> performed by security gateways."

In interpret your statement that routing headers are somehow different
than regular forwarding. Is this what you intend?

Or do you intend?
"An router forwarding packets (whether using routing headers or not)
might implement security policy checks."

I still don't see why routing headers need to be any different.

   Erik