Re: [saag] IPsec spec problems

[Stephen Kent <kent at bbn.com>]

At 6:29 AM -0700 4/28/06, Vishwas Manral wrote:
> Pekka,
>
> I agree with you here. I had brought out a similar issue of 
> supporting both the modes Tunnel and transport on most routers in 
> the IPsec list.
>
> In my view the lesser the number of combinations the better it is in 
> all respects. Is there a reason why we cannot have Tunnel mode a 
> MUST and not Transport mode when working as a host. I know it saves 
> on bytes in the header. Is it a big enough motivation to have to 
> support 2 modes on most routers?
>
> Thanks,
> Vishwas

Vishwas,

We had this discussion on the IPsec list several years ago.  Everyone 
agreed that if we could mandate just one mode, that would be 
preferable, but the group was divided over which mode that was!

Tunnel mode overhead is substantial compared to transport mode 
overhead and thus folks who are concerned about the per-packet 
overhead were not willing to give up transport mode for host-to-host 
communication.

Let's not have this debate again.  In general I feel that it's not 
fair to a WG to re-open discussions after the WG has closed, unless 
there is a serious technical error in the WG's documents. Otherwise 
we invite folks to wait for a WG to close and then pursue an agenda 
that was rejected by WG members during its lifetime.

Steve