Re: [secdir] secdir review of draft-ietf-ipsecme-ikev2-ipv6-config-02.txt

[<[e-mail]>]

Dave Cridland wrote:

> I was under the impression it potentially moved one of the ends in
> any communication away from the tunnel endpoint?
> 
> That is, if one is connecting into a secured, trusted network, using
> this secured VPN tunnel, that doesn't mean that any packets
> traversing a local network to get to that tunnel are secured. (For
> whatever meaning of secured you intend to put here).
> 
> To put it another way, under RFC 4306, the client VPN'ing into the
> network is always "attached to the IPSec tunnel", whereas this
> document extends things such that this may not be the case.

No, not really; a VPN client using plain RFC 4306 can also share its
IPv4 VPN connection to other hosts in the vicinity if it wants; it
just needs to do NATting, while here we avoid the NAT.

(And this is relatively common case for IPv4 VPNs nowadays -- the
"other hosts" using the VPN connection are most likely VMs running
on the same physical hardware.)

Best regards,
Pasi