Subject: [L2tpext] Re: UDP-encapsulated IPsec Transport mode

From: Markus Stenberg <[email-masked]>
Date: 07 Nov 2002 09:51:02 +0200

James Huang <[email-masked]> writes:
> Hi all,
> 	In the appendix A of draft-ietf-ipsec-udp-encaps-04.txt, there is
> some discussions on the issue of multiple clients running UDP-encapsulated
> IPsec transport mode tunnels behind a NAT box.  However, I did not find any
> discussion on another related issue:  In the traffic selector (ID) payload
> the client sends out during quick mode exchange, should the client use its
> own private address or the public routable address (i.e. the NAT box's
> public IP address)?  If it the later, how does the client know about that
> public address?  This seems to be a serious issue, especially for L2TP
> voluntary tunnels secured by IPsec (in transport mode).

L2TP specific issues I am blissfully unaware of; however, because the NAT
boxes are not neccessarily even controlled by the IPsec user, sending the
public address is not really an option that can be supported everywhere.

Here's how the information flow goes as far as I see it:

 Public address doesn't really need to be sent in any case as the remote
 side's public address is the address we're talking IKE with (or at least
 remote address+port combination, but in NAPT case you don't really have
 more of an remote address in any case).

 Private address that is used by the OS for actual traffic is provided
 within the NAT-OA payload so the checksums et al can be corrected.

Therefore, at least as far as implementation I used to work on goes, ID
payload in transport mode case doesn't matter (I seem to recall we sent
private address, but pretty much ignored what was sent by remote).

-Markus

> Regards,
> James C. Huang

-- 
"Every program has (at least) two purposes: the one for which it was
written, and another for which it wasn't. "

From ACM's SIGPLAN publication, (September, 1982), Article "Epigrams
in Programming", by Alan J. Perlis of Yale University.
_______________________________________________
L2tpext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/l2tpext

---

From: Markus Stenberg <[email-masked]>
Date: 07 Nov 2002 09:51:02 +0200

-Markus

---

From: Bora Akyol <[email-masked]>
Date: Fri, 8 Nov 2002 15:29:39 -0800 (PST)

I wrote about this same topic about 4-6 weeks ago.

If you use transport mode, then you have to recalc the TCP checksum of the
packets at the host that is behind the NAT box. Normally this is a low-end
sw client and the bandwidth is limited (the linksys in my lab starts
dropping packets at a few mbps), so tcp checksum recalc is not a huge
issue for 90% of scenarios.

And for the other 10%, one can always use tunnel mode. Actually, I expect
100% of the people to use tunnel mode, but I have been wrong before.

Bora

On Fri, 8 Nov 2002, Satyadeva Konduru wrote:

> James,
> Will there be any problem if the gateway (or any peer) treats the NATed
> public address as the Phase 2 traffic selector, ignoring the private
> address sent by client ? Obviously, the private address is of no use to
> the gateway. Even the SPD lookup policy is based on the NATed address.
>
> One other way the authors could have pursued is: the IKE gateway sending
> the NATed address (NA) to the client in the Phase 1 as a NAT-NA payload.
> This way, the client will get to know of its public address. But since
> the NAT-NA can dynamically change, the gateway has to send the NAT-NA
> payload every time the NATed public address changes.
>
> -Satyadeva Konduru
>
> > -----Original Message-----
> > From: [email-masked]
> [mailto:[email-masked]]
> > On Behalf Of James Huang
> > Sent: Wednesday, November 06, 2002 4:12 PM
> > To: [email-masked]; [email-masked]'
> > Subject: UDP-encapsulated IPsec Transport mode
> >
> > Hi all,
> > IPsec transport mode tunnels behind a NAT box.  However, I did not
> find
> > any

---

From: "Satyadeva Konduru" <[email-masked]>
Date: Fri, 8 Nov 2002 14:51:01 -0800

James,

-Satyadeva Konduru

find

---

From: Bora Akyol <[email-masked]>
Date: Fri, 8 Nov 2002 15:29:39 -0800 (PST)

Bora

---

From: "Satyadeva Konduru" <[email-masked]>
Date: Fri, 8 Nov 2002 14:51:01 -0800

James,

-Satyadeva Konduru

find