Subject: (IPng 7306) RE: mobility and IPsec tunnel mode

From: Richard Draves <[email-masked]>
Date: Thu, 11 Mar 1999 10:25:57 -0800

> If you use tunnel mode in place of transport mode for common
> packets (ie without binding options) you can use:
> 
> from correspondent to mobile:
> 
> Outer IPv6 header
>  destination=care-of address
> IPSec header
>  authentication and replay prevention
> Inner IPv6 header
>  destination=home address
> Higher level data

This is an interesting idea. I think it would work IF the receiving mobile
node has enabled forwarding on the receiving interface, ie, is behaving as a
security gateway.

That's because this packet looks exactly like a packet sent with a
tunnel-mode association with a security gateway.

When the implementation processes the inner IPv6 header and sees that the
destination address is different than the destination address in the outer
IPv6 header, it will invoke the security gateway / forwarding path, and a
normal host will drop the packet.

The advantage of the routing header is that hosts implement routing headers.

Rich
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------