Subject: [Ipsec] Re: Outbound SA Bundle processing

From: Stephen Kent <[email-masked]>
Date: Mon, 3 May 2004 21:54:34 -0400

At 1:46 PM +0530 4/21/04, Raghava Rao wrote:
>Hi,
>
>Same issue was raised in one of the bakeoff (MAY 1999).
>Some vendors supported format 2 and some format 1.
>But most of the vendors supported one TUNNEL IP header for both AH 
>and ESP together.
>
>In my view security over head can be reduced in format 1
>by avoiding the additional TUNNEL IP header construction in the format 2.
>
>-raghava

I won't dispute what vendors may have implemented, but not everything 
that vendors ave done has been consistent with the RFCs.

It is also obvious that omitting an IP layer reduces overhead.

If you look at the new processing model, it allows nesting of SAs 
through a loopback mechanism, using appropriate entries in the SPD 
and forwarding tables. This model makes it clear that two headers 
would be required, because each IPsec protocol would be applied on a 
separate pass across the Ipsec boundary, and thus the IP header 
structure needed by tunnel mode would have to be present on each 
pass.  so, if there was any ambiguity in 2401 in this regard, it is 
removed in 2401bis.

steve

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Stephen Kent <[email-masked]>
Date: Mon, 3 May 2004 21:54:34 -0400

steve