IETF Logo Mail Archive

Re: ipsec in tunnel mode and dynamic routing

"Steven M. Bellovin" <smb@research.att.com> Mon, 19 November 2001 20:28 UTC

Received: from lists.tislabs.com (portal.gw.tislabs.com [192.94.214.101]) by above.proper.com (8.11.6/8.11.3) with ESMTP id fAJKSb820651; Mon, 19 Nov 2001 12:28:37 -0800 (PST)
Received: by lists.tislabs.com (8.9.1/8.9.1) id OAA10225 Mon, 19 Nov 2001 14:40:29 -0500 (EST)
X-Mailer: exmh version 2.5 07/13/2001 with nmh-1.0.4
From: "Steven M. Bellovin" <smb@research.att.com>
To: Derek Atkins <warlord@mit.edu>
Cc: Lars Eggert <larse@ISI.EDU>, Ricky Charlet <rcharlet@redcreek.com>, Giaretta Gerardo <Gerardo.Giaretta@TILAB.COM>, ipsec@lists.tislabs.com, xbone@ISI.EDU
Subject: Re: ipsec in tunnel mode and dynamic routing
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Mon, 19 Nov 2001 14:49:41 -0500
Message-Id: <20011119194941.403247C00@berkshire.research.att.com>
Sender: owner-ipsec@lists.tislabs.com
Precedence: bulk

In message <sjm7ksmk0g1.fsf@benjamin.ihtfp.org>, Derek Atkins writes:
>If all you want is to use IPsec for packet encryption and don't care
>about access control, this should suffice.  However you wont get
>source-address verification of packets.
>

It's not source address verification I'm concerned about, it's 
connection hijacking and DOSing.

		--Steve Bellovin, http://www.research.att.com/~smb
		Full text of "Firewalls" book now at http://www.wilyhacker.com

v2.37.1 | Report a Bug | By Email | System Status