Re: IPsec support for NAT-PT in IPv6

[Francis Dupont <Francis.Dupont@enst-bretagne.fr>]

 In your previous mail you wrote:

   in 2.1 ==> My proposed mechanism was assume IKE using preshared key Phase.

=> preshared key with not predictable address doesn't work in main mode,
there is nothing to do to fix that because this is an intrinsic feature
(identity protection).

   If we can't IKE using use certificate, we should use IKE using other way.
   
   in IPsec using UDP encapsulation ==> NAT-PT can't apply to it.

=> why? UDP encapsulation is there to help header translation and is
not limited to NAT.

   If we use IPsec using UDP encapsulation in NAT-PT, NAT-PT server
   may send IPv4-in-IPv6 packet.

=> I can't see the problem: the user wants to protect and encapsulate
its IPv6 packet...

   However IPv4 node don't understand IPv6 packet.
   
=> so tunnel mode is not usable but transport is.

   Therefore, NAT traversal method can be applied to NAT-PT mechanism.
   
Regards
   
Francis.Dupont@enst-bretagne.fr