Re: Comments regarding IPsec NAT traversal / new proposal

[Jim Tiller <[e-mail]>]

AH> ASSUMPTION: We do *not* wish to use the same UDP port for both IKE and
AH> IPsec traffic encapsulated in UDP. This is because we'd loose the possibility
AH> to filter these traffic types separately in a firewall. For this purpose we've
AH> reserved the port 2797 from IANA.
This should be a default with an option to modify at the remote system/initiator. The
reasoning is that port 2797 may not be typically open in foreign networks, in that event
the initiator can request to establish the session over a common port (i.e. 53) that is
typically open on firewalls.

AH> In particular, the method of negotiating and setting up UDP encapsulation as
AH> defined in draft-stenberg-ipsec-nat-traversal-00.txt is too complex. We propose the following
AH> mechanism for discussion:
AH> 1) IKE phase 1 is not modified.
AH> 2) IKE phase 2 adds a new protocol ID,
AH>        Protocol ID                         Value
AH>        -----------                         -----
AH>        RESERVED                            0
AH>        PROTO_ISAKMP                        1
AH>        PROTO_IPSEC_AH                      2
AH>        PROTO_IPSEC_ESP                     3
AH>        PROTO_IPCOMP                        4
AH>        PROTO_IPSEC_ESP_OVER_UDP            X

Agreed - however, your assuming IKE will survive NAT. Will this affect the available
authentication mechanisms?

-jim