Re: AH (without ESP) on a secure gateway

[Bill Sommerfeld <[e-mail]>]

> This is more an implementation issue rather than a standards issue.  If you
> have an IPSEC-compliant firewall, then ESP Transport Mode could be used for
> firewall-to-firewall encryption.  Vendors should note in their
> documentation about possible problems and issues with this mode for
> firewall-to-firewall communications.  

There may be a terminology clash here.  By "firewall", do you mean
"filtering border router" or "application-layer gateway" or what?

I know I'm repeating myself (and others), but I think we've
(re)established over the past few days that performing transport-mode
ESP or AH encapsulation/decapsulation in a router is problematic.

If the end systems are also using ESP and AH, both the receiving end
system and the receiving router could allocate the same numeric SPI
and there wouldn't be an unambiguous interpretation of each packet.

This would impede deployment of end-to-end ESP/AH, and I think that's
reason enough to specify that configuration as a "SHOULD NOT" or "MUST
NOT"..'

					- Bill