Subject: RE: IPSec over GRE why ?

From: "Shelton, Raymond A." <[email-masked]>
Date: Tue, 25 Feb 2003 13:43:19 -0600

I wasn't that person, but let's pretend I play him on T.V. for a moment...
imagine that I have a GRE tunnel to a remote clinic; further suppose I need the traffic to be IPSec b/c of HIPPA regs.  Should I have more accurately asked for IPSec in GRE, as opposed to GRE w/in IPSec? 

ras

-----Original Message-----
From: Derek Atkins [mailto:[email-masked]]
Sent: Tuesday, February 25, 2003 11:24 AM
To: [email-masked]
Cc: [email-masked]
Subject: Re: IPSec over GRE why ?

Why don't you ask the person who told you to use GRE?

-derek

"Sandeep Sakhuja" <[email-masked]> writes:

> Hi
> 
> I am Sandeep. I am working on implementing IPSec lab. When implementing IPSec
> across different routing domains we need to use GRE or IIPTran. My Question is
> why do I have to use the same. IPSec does not support multicast packets that is
> known, but then my interesting traffic which I need to be protected is not the
> routing updates, so why do I have to use GRE ?
> 
> Thanks
> - Sandeep
> 

-- 
       Derek Atkins
       Computer and Internet Security Consultant
       [email-masked]             www.ihtfp.com

---

From: "Derek Atkins" <[email-masked]>
Date: 25 Feb 2003 16:01:20 -0500

Well, a better question back at you.  If you're using IPsec, why do
you need a GRE tunnel?  What's wrong with just using the IPsec tunnel?

Tunneling IPsec within GRE would still leave you open to attack,
because you'd have to block all non-IPsec traffic anyways (to make
sure someone couldn't insert traffic into your VPN).  So what purpose
is the GRE serving at that point?

Tunneling GRE within IPsec would work, but I would only suggest it if
you are trying to tunnel non-IP packets.  If you're just trying to
tunnel IP packets, then just use IPsec's tunnel-mode and be done with
it.

-derek

---

From: Derek Atkins <[email-masked]>
Date: 25 Feb 2003 16:53:43 -0500

Lars,

Lars Eggert <[email-masked]> writes:

> On 2/25/2003 1:01 PM, Derek Atkins wrote:
> Not if existing dynamic routing protocols are required inside the
> virtual topology. See draft-touch-ipsec. (Details in my earlier reply.)

The requirement to run dynamic routing protocols was NOT the question
asked.  Please re-read Shelton's question before commenting on my
answer.  Quoting my answer out of context and applying alternate
requirements is both rude and unhelpful.

In particular, he asked:

> imagine that I have a GRE tunnel to a remote clinic; further suppose I
> need the traffic to be IPSec b/c of HIPPA regs.  Should I have more
> accurately asked for IPSec in GRE, as opposed to GRE w/in IPSec?

I see nothing in here about dynamic routing protocols.  Do you?

> Lars

-derek

PS: I see no earlier reply in this thread.  What is the subject and
messageID of your earlier reply?

---

From: Lars Eggert <[email-masked]>
Date: Tue, 25 Feb 2003 14:12:01 -0800

> I see nothing in here about dynamic routing protocols.  Do you?

Sorry. I missed that it was Raymond and not Sandeep (the sender of the
original email) who sent the email you replied to. I agree that
Raymond's requirements are probably different from Sandeep's.

> messageID of your earlier reply?

Message-ID: <[email-masked]>
Date: Mon, 24 Feb 2003 23:30:41 -0800
From: Lars Eggert <[email-masked]>
To: [email-masked]
CC: [email-masked], xbone <[email-masked]>
Subject: Re: IPSec over GRE why ?

Lars
-- 
Lars Eggert <[email-masked]>           USC Information Sciences Institute

---

From: Lars Eggert <[email-masked]>
Date: Tue, 25 Feb 2003 13:28:51 -0800

Lars