IETF Logo Mail Archive

Re: IPSEC Security Gateways & NAT

"Steven M. Bellovin" <smb@research.att.com> Thu, 07 June 2001 14:09 UTC

Received: from lists.tislabs.com (portal.gw.tislabs.com [192.94.214.101]) by above.proper.com (8.9.3/8.9.3) with ESMTP id HAA09309; Thu, 7 Jun 2001 07:09:55 -0700 (PDT)
Received: by lists.tislabs.com (8.9.1/8.9.1) id JAA22319 Thu, 7 Jun 2001 09:11:14 -0400 (EDT)
X-Mailer: exmh version 2.1.1 10/15/1999
From: "Steven M. Bellovin" <smb@research.att.com>
To: Joern Sierwald <joern.sierwald@F-Secure.com>
Cc: ipsec@lists.tislabs.com, Chris Trobridge <CTrobridge@baltimore.com>
Subject: Re: IPSEC Security Gateways & NAT
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Mime-Version: 1.0
Date: Thu, 07 Jun 2001 09:16:27 -0400
Message-Id: <20010607131627.C99717B84@berkshire.research.att.com>
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by lists.tislabs.com id JAA22315
Sender: owner-ipsec@lists.tislabs.com
Precedence: bulk

In message <3.0.5.32.20010607143550.047a3380@smtp.datafellows.com>, Joern Sierw
ald writes:

>>
>
>The consensus among IPsec vendors is ESPoUDP. You use tunnel mode,
>and insert a UDP header in front of the ESP header. This is dead simple
>and works with normal NAT boxes.
>

I don't know that I'd use the word "consensus" -- and I would note that 
that SSH has claimed assorted patent rights to the concept, at least as 
explained in draft-stenberg-ipsec-nat-traversal-*.txt.


		--Steve Bellovin, http://www.research.att.com/~smb

v2.23.0 | Report a Bug | By Email