Subject: [Hipsec] Updating moskowitz-hip-07: IPv4 pseudo header

From: [email-masked] (Henderson, Thomas R)
Date: Fri Sep 5 15:42:01 2003

> -----Original Message-----
> From: Pekka Nikander [mailto:[email-masked]]
> Sent: Friday, September 05, 2003 12:03 PM
> To: Henderson, Thomas R
> Cc: [email-masked]
> Subject: Re: [Hipsec] Updating moskowitz-hip-07: IPv4 pseudo header

>=20
> > It would be nice to figure out a way to avoid the need for any HIP=20
> > awareness in IPv4 NATs, at least for the most common=20
> "outbound from a
> > private network to a public network server" case.  HIP over TCP, or
> > UDP/STUN?
>=20
> Well, it is not enough to tunnel just the HIP protocol
> over TCP, UDP or UDP/STUN.  You must also tunnel the resulting
> ESP SAs.  Therefore, I think that while such practise is probably
> valuable, it warrants a separate specification, and should not
> be included in the base spec.

I agree about handling it in a separate spec.  For the ESP tunneling,
there are already efforts in ipsec WG for tunneling through NATs--
they may be of use.

>=20
> On the other hand, if HIP gets commonplace, I would expect
> many NAT vendors to provide firmware updates that teach the
> NAT boxes to process the HIP packets and to set up the
> SPI mappings so that ESP works.
>=20
Yes, but we have a chicken-and-egg problem here with the massive
NAT deployment in place.  NAT is deployed in lots of products=20
nowadays-- some of which may not have a convenient upgrade path.

Tom

---

From: [email-masked] (Pekka Nikander)
Date: Sat Sep 6 00:18:01 2003

> there are already efforts in ipsec WG for tunneling through NATs--

Good that we agree on a separate spec.  Yes, we can probably
use the IPsec WG specs, but we need to be careful with the
IPR swamp there.

> NAT deployment in place.  NAT is deployed in lots of products 

Right.  That's the reason why I think that we need the
separate spec for making HIP to work with current NAT boxes.
I don't want to sacrifice the architectural beauty in the
base specifiction for making NAT traversal to work today.

Thus, any volunteers for the separate UDP tunneling based
NAT spec?

--Pekka