Subject: [IPsec] Should draft-ietf-ipsecme-tcp-encaps-10 update 7296 ?

From: Paul Wouters <[email-masked]>
Date: Thu, 1 Jun 2017 19:17:31 -0400 (EDT)

On Wed, 31 May 2017, Tommy Pauly wrote:

> I've posted a new version of the draft that incorporates the changes discussed in this thread. Please review!
> 
> https://datatracker.ietf.org/doc/html/draft-ietf-ipsecme-tcp-encaps-10

I just noticed this in RFC 7296:

 	However, if a NAT is detected, both devices MUST use UDP encapsulation for ESP.

I'm not sure if this one sentence really qualifies as this draft needing
a formal "Updates 7296", but it currently does not seem to do that.

Paul

---

From: Tommy Pauly <[email-masked]>
Date: Thu, 01 Jun 2017 16:34:58 -0700

> On Jun 1, 2017, at 4:17 PM, Paul Wouters <[email-masked]> wrote:
> 

Technically, one should only do TCP encapsulation if UDP couldn't go through at all—so you couldn't even get the IKE_SA_INIT response to do NAT detection. That means that we aren't in this case. However, I'm happy to add a line to clarify this if we'd prefer that =)

Thanks,
Tommy