Subject: [BEHAVE] Comments on NAT64 draft

From: Zhen Cao <[email-masked]>
Date: Wed, 16 Dec 2009 00:03:43 +0800

Hi All,

I have a short comment for the latest NAT64 draft relating to IPsec.

1. In section.5, it states: "this implies that end to end IPSec
verification will fail when AH is used (both transport and tunnel
mode) and when ESP is used in transport mode". For AH, this is
correct. But for ESP, transport mode can be supported because the
outer sider IP header is not counted into the secure computation. The
xlate draft also states: "Note that ESP transport mode is easier to
handle than ESP tunnel mode;"

2. In section 1.1, it says "some forms of IPsec support", and it might
be too vague?

Thanks and regards,
Zhen

---

From: marcelo bagnulo braun <[email-masked]>
Date: Tue, 15 Dec 2009 22:51:13 +0100

Hi,

thanks for the comments,

see below...

Zhen Cao escribió:
> mode) and when ESP is used in transport mode".
right, this was ESP in tunnel mode, since the inner header cannot be 
translated by the NAT64 in that case.
I fixed that

>  For AH, this is
right, it is vague, because is not defined in thsi document. I will add 
comment stating that the IPsec support is out of the scope of this 
specification (as agreed by the WG in the dublin meeting)

Regards, marcelo