Subject: (IPng 7594) Re: mobile-ipv6 and ipsec

From: Richard Draves <[email-masked]>
Date: Wed, 2 Jun 1999 15:42:44 -0700

I would like to followup on Aaron's mail with a quick example that shows how
complex the IPsec & mobility interaction can be. We had a discussion a few
months ago about all this, but it didn't really resolve the issues.

Suppose you initiate a TCP connection with a host MH. Your SPD says to use
transport-mode AH when communicating with the home address. So the TCP
connection is protected with transport-mode AH. All is well.

Then the host MH moves. In fact it moves behind a security gateway SG and
assumes a care-of address. Your SPD tells you to use tunnel-mode ESP to SG
when communicating with the care-of address.

In this case your SPD says to use transport-mode AH for the home address and
tunnel-mode ESP for the care-of address.

I think the desired result is that you send packets protected both ways -
the outer headers are tunnel-mode (to SG) ESP, the inner headers are
transport-mode AH.

Rich
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------