RE: ingress filteing problem

["Kanchei Loa" <loa@ieee.org>]

Spencer Dawkins wrote:

> I'm probably late to the party, but don't (1) and (2) break
> transport-mode IPsec?
>

(1) depicts schemes to forward IP packet to the "correct" ISP such that the
source address is matching ISP's ingress filter. There is no IP src/dst
rewriting during the process. So, transport-mode IPsec won't be affected.

(2) use NAT to rewrite the locators (IP src/dst) in order to pass through
ISP's ingress filter and provides consistent src/dst address pair for
non-multi6 host at another end of the communication. It is no better (or
worse) than existing NAT deployments regarding IPsec compatibility issues.

> So IPsec transport mode would be a non-goal?
>

I can't speak for the WG. But I believe one of the goal is not to introduce
new threats.

This is quote from "Goals for IPv6 Site-Multihoming Architectures (RFC
3582)".

4.  Security Considerations

   A multihomed site should not be more vulnerable to security breaches
   than a traditionally IPv4-multihomed site.

   Any changes to routing practices made to accommodate multihomed sites
   should not cause non-multihomed sites to become more vulnerable to
   security breaches.

--------------
Kanchei Loa
loa@ieee.org