<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:arial, helvetica, sans-serif;font-size:10pt"><div>Hi Andreas,</div><div> Thanks for your reply. So if there exists a third IPSec tunnel from Gateway 2 to Host B,</div><div>there would be 3 layers of encapsulation, right? That is first encapsulation for tunnel between Host A and </div><div>Gateway 1, second encapsulation between Gateway 1 and Gateway 2, and third encapsulation between</div><div>Gateway 2 and Host B. So the packet received at Host B would appear something like</div><div><br></div><div>New IP | ESP | IP | ESP | IP | ESP | Orig IP | UDP</div><div> |<---------1st----------->|</div><div>
|<-----------------2nd----------------->|</div><div> |<--------------------------3rd------------------------->|</div><div><br></div><div>So I believe the IP Stack on Host B needs to decrypt the received packet 3 times to get the Original IP packet, right?</div><div><br></div><div>Please correct me if I am wrong.</div><div><br></div><div><br></div><div>Thanks,</div><div>Bharat</div><div><br></div><div><br></div><div><br></div><div><br></div><div style="font-family:arial, helvetica, sans-serif;font-size:10pt"><br><div style="font-family:arial, helvetica, sans-serif;font-size:13px"><font size="2" face="Tahoma"><hr size="1"><b><span style="font-weight: bold;">From:</span></b> Andreas Steffen <andreas.steffen@strongswan.org><br><b><span style="font-weight: bold;">To:</span></b> Bharat S <bharat.sarvan@yahoo.com><br><b><span
style="font-weight: bold;">Cc:</span></b> users@lists.strongswan.org<br><b><span style="font-weight: bold;">Sent:</span></b> Sun, January 9, 2011 4:51:32 AM<br><b><span style="font-weight: bold;">Subject:</span></b> Re: [strongSwan] IPSEC Processing on a Security Gateway<br></font><br>
Hello Bharat,<br><br>if you have an IPsec tunnel between Host A and Host B<br>and an IPsec tunnel between Gateway 1 and Gateway 2<br>then the Host-to-Host ESP packets will be encapsulated<br>by the Gateway-Gateway tunnel:<br><br> New IP | ESP | IP | ESP | Orig IP | UDP |<br> |<--inner tunnel-->|<br> |<------ outer tunnel ------->|<br><br>Regards<br><br>Andreas<br><br>On 01/08/2011 06:04 AM, Bharat S wrote:<br>> Hi all,<br>> I have a question regarding IPSec processing on Security Gateway (SEG).<br>> Consider a network as below.<br>><br>><br>> Host A ----------------------Gateway<br>> --------------------Gateway--------------------Host B<br>> 1 2<br>><br>> If suppose the IPSec tunnel is required to be initiated from Host A to<br>> Host B, I was wondering
how will the IPSec packets be<br>> processed on route to Host B. Lets say its ESP in tunnel mode. The<br>> packet from Host A to Gateway 1 would appear as below<br>><br>><br>> New IP | ESP | Orig IP | UDP<br>><br>> My question is, when this packet is received on Gateway 1, will the ESP<br>> header of this packet be decrypted to form another ESP<br>> and the resulting packet going out would appear like<br>><br>> New IP | ESP | Orig IP | UDP<br>><br>><br>> OR<br>><br>> Or its the entire IP packet received is given as input to form another<br>> ESP packet.. And the resulting packet going out would appear like<br>><br>> New IP | ESP | IP | ESP | Orig IP | UDP<br>> |<-----------hashed---------> |<br>><br>><br>> I hope you have got my question. Please correct me If am wrong at any<br>> place.. And would appreciate if you could guide me to some<br>> specification that explains the
IPSec Processing on Gateways.<br>><br>><br>> Many Thanks,<br>> Bharat<br>><br><br>======================================================================<br>Andreas Steffen <a ymailto="mailto:andreas.steffen@strongswan.org" href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a><br>strongSwan - the Linux VPN Solution! <a target="_blank" href="http://www.strongswan.org">www.strongswan.org</a><br>Institute for Internet Technologies and Applications<br>University of Applied Sciences Rapperswil<br>CH-8640 Rapperswil (Switzerland)<br>===========================================================[ITA-HSR]==<br></div></div><div style="position:fixed"></div>
</div><br>
</body></html>