Re: [Ipsec] Number of SPD Policies

[Tero Kivinen <kivinen at iki.fi>]

Subha writes:
> If AH+ESP between the same two gateway devices is not 
> actually providing any extra crypographic protection,
> why have it at all. 

True.

> 2401bis could have simply removed that combination. 

2401bis did remove it as a single concept.

The reason there is still the forwarding step is when you have
following case:

Host A <-------> SGW <-----> Host B

and where Host A needs to authenticate all his packets with tunnel
mode AH to the SGW before it can get through it (i.e. the Host A might
be somewhere inside the internet, and the SGW is the corporate
firewall, requiring authentication before letting any traffic in, but
as all traffic is also protected by ESP end to end, AH is enough for
the SGW). In addition to that Host A needs to create transport mode
ESP to connect to the Host B (lets say financial server or something).

Now the Host A do need to have both AH and ESP applied to the packet,
and his policy would be:

Host A, Host B, ESP or IKE use tunnel mode AH to SGW
Host A, Host B, any traffic use transport mode ESP, reforward to IPsec

> Also, my understanding is that having AH over ESP provides
> additional protection on the tunnel header, which is otherwise
> not handled by ESP with Auth.

If the ESP is in tunnel mode the external header is thrown away, so
the protection AH offers to it is not useful. 
-- 
kivinen at safenet-inc.com

_______________________________________________
Ipsec mailing list
Ipsec at ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec