<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>It might not be addressed due to Ipsec being an integral part of the IPv6 specification, with the expectation that firewalls must be able to pass IPv6 Ipsec traffic to be compliant.</div>
<div><br>
</div>
<div>I'd be interested in a more authoritative answer!</div>
<div><br>
</div>
<div>/Ryan</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Mukesh Yadav <<a href="mailto:write2mukesh84@gmail.com">write2mukesh84@gmail.com</a>><br>
<span style="font-weight:bold">Date: </span>Wednesday, April 15, 2015 at 12:16 PM<br>
<span style="font-weight:bold">To: </span>Ryan Ruel <<a href="mailto:rruel@akamai.com">rruel@akamai.com</a>><br>
<span style="font-weight:bold">Cc: </span>"<a href="mailto:users@lists.strongswan.org">users@lists.strongswan.org</a>" <<a href="mailto:users@lists.strongswan.org">users@lists.strongswan.org</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [strongSwan] Query reg UDP encapsulation for IPv6<br>
</div>
<div><br>
</div>
<div>
<div>
<div dir="ltr">Hi Ryan,
<div><br>
</div>
<div>Definitely NAT is not needed in case of IPv6 tunnel end-points.
<div>But RFC 5996 doesn't clearly say something about it. </div>
<div>Also there mentioned a use-case in RFC-5996 where firewalls might have been configured for only UDP(port based) traffic to by-pass.</div>
<div>In that case peer might be using UDP-encapsulation for IPv6 tunnel even if NATT is not detected..</div>
<div><br>
</div>
<div>Thanks</div>
<div>Mukesh </div>
</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On 15 April 2015 at 19:45, Ruel, Ryan <span dir="ltr"><<a href="mailto:rruel@akamai.com" target="_blank">rruel@akamai.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif">
<div>Mukesh,</div>
<div><br>
</div>
<div>I believe the idea is that for IPv6, NAT will not be needed (that's the beauty of having so much address space!).</div>
<div><br>
</div>
<div>Technically, sure, you could NAT IPv6. But why?</div>
<div><br>
</div>
<div>/Ryan</div>
<div><br>
</div>
<span>
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;BORDER-BOTTOM:medium none;BORDER-LEFT:medium none;PADDING-BOTTOM:0in;PADDING-LEFT:0in;PADDING-RIGHT:0in;BORDER-TOP:#b5c4df 1pt solid;BORDER-RIGHT:medium none;PADDING-TOP:3pt">
<span style="font-weight:bold">From: </span>Mukesh Yadav <<a href="mailto:write2mukesh84@gmail.com" target="_blank">write2mukesh84@gmail.com</a>><br>
<span style="font-weight:bold">Date: </span>Wednesday, April 15, 2015 at 9:56 AM<br>
<span style="font-weight:bold">To: </span>"<a href="mailto:users@lists.strongswan.org" target="_blank">users@lists.strongswan.org</a>" <<a href="mailto:users@lists.strongswan.org" target="_blank">users@lists.strongswan.org</a>><br>
<span style="font-weight:bold">Subject: </span>[strongSwan] Query reg UDP encapsulation for IPv6<br>
</div>
<div>
<div class="h5">
<div><br>
</div>
<div>
<div>
<div dir="ltr">
<div>HI,</div>
<div><br>
</div>
<div>My question is more towards IKEv2 standard rather strongswan explicitly.</div>
<div>UDP encasulation is used for NATT traversal in IPsec for both ESP/IKE.</div>
<div><br>
</div>
<div>RFC 5996, says even if NATT is not detection sending IKE/ESP on 4500 is optional but receiving should be handled. </div>
<div>RFC 5666 reference:</div>
<div><i>"When either side is using port 4500, sending ESP with UDP encapsulation is</i></div>
<div><i> not required, but understanding received UDP-encapsulated ESP packets is required"</i></div>
<div><br>
</div>
<div>Having said that this all fine for IPv4, but for IPv6 is it possible that NATT is not detection and still IKE/ESP exchanges are done on port 4500 as UDP encapsulated.</div>
<div><br>
</div>
<div>One reference from RFC I can is below which says that IKE/ESP can always be on port 4500 even if NAT not detected, but not clear whether same is applicable for IPv6 as well.</div>
<div><i>" IKEv2 will use UDP encapsulation of IKE and ESP packets. This encoding is slightly less</i></div>
<div><i> efficient but is easier for NATs to process. In addition, firewalls</i></div>
<div><i> may be configured to pass UDP-encapsulated IPsec traffic but not plain, unencapsulated ESP/AH or vice versa."</i></div>
<div><br>
</div>
<div>Any opinion or suggestion for same will appreciated.</div>
<div><br>
</div>
<div>Thanks</div>
<div>Mukesh</div>
</div>
</div>
</div>
</div>
</div>
</span></div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</span>
</body>
</html>