Subject: [Pana] Issue 213 (AD-review, pana-fwk, section 10.2.1.1)

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 02 Nov 2005 19:41:13 -0500

>10.2.1.1  IPv4
>
>
>   Case A: IPsec-TIA obtained by using DHCPv4
>
>      In this case, the IPsec-TIA and IPsec-TOA are the same as the
>      PRPA, and all configuration information including the IP address
>
>

Are you using IPsec for tunneling, security, or both here? If it is for
security alone (implied by the fact that the TIA and TOA are the same as
the PRPA) then why not use IPsec transport mode?

>is obtained by using DHCPv4 [RFC2131].  No POPA is configured.
>      Case A is the simplest compared to other ones and might be used in
>      a network where IP address depletion attack on DHCP is not a
>      significant concern.  The PRPA needs to be a routable address
>      unless NAT is performed on AR.

  Ohba: IPsec is used for both tunneling and security.  IPsec-TIA and
  IPsec-TOA are the same in Case A, but IPsec-TIA may not be the only
  address carried in inner header.  If the PaC is a router, it is
  possible that addresses of other devices attaching to the PaC are
  carried in inner header in addition to the IPsec-TIA which is the
  PaC's address by definition.  For this reason, IP-in-IP transport
  mode SA was not adopted in pana-ipsec.

Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana