Subject: [anonsec] BTNS and Tunnels

From: sommerfeld at sun.com (Bill Sommerfeld)
Date: Tue, 08 Nov 2005 11:17:30 -0800

On Mon, 2005-10-31 at 12:30, Black_David at emc.com wrote:
> I support Tero's comments on NAT-T - getting that into IPsec took enough
> work that we should avoid damaging or breaking it - it's entirely too
> useful ;-).

agreed.  but, on the other hand, if there is existing unauthenticated
communication between A and B, it should not be possible for "C" to make
an unauthenticated BTNS connection to B, claim an inner tunnel address
of A, and vacuum up traffic for "A"...

Requiring that C = A (either directly, or indirectly by use of transport
mode) makes the problem go away.  There may be other ways as well.

						- Bill

---

From: paul at xelerance.com (Paul Wouters)
Date: Tue, 8 Nov 2005 20:33:21 +0100 (CET)

> mode) makes the problem go away.  There may be other ways as well.

Transport mode and NAT-T is not a happy combination though.

Paul