<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>Mukesh,</div>
<div><br>
</div>
<div>I believe the idea is that for IPv6, NAT will not be needed (that's the beauty of having so much address space!).</div>
<div><br>
</div>
<div>Technically, sure, you could NAT IPv6. But why?</div>
<div><br>
</div>
<div>/Ryan</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Mukesh Yadav <<a href="mailto:write2mukesh84@gmail.com">write2mukesh84@gmail.com</a>><br>
<span style="font-weight:bold">Date: </span>Wednesday, April 15, 2015 at 9:56 AM<br>
<span style="font-weight:bold">To: </span>"<a href="mailto:users@lists.strongswan.org">users@lists.strongswan.org</a>" <<a href="mailto:users@lists.strongswan.org">users@lists.strongswan.org</a>><br>
<span style="font-weight:bold">Subject: </span>[strongSwan] Query reg UDP encapsulation for IPv6<br>
</div>
<div><br>
</div>
<div>
<div>
<div dir="ltr">
<div>HI,</div>
<div><br>
</div>
<div>My question is more towards IKEv2 standard rather strongswan explicitly.</div>
<div>UDP encasulation is used for NATT traversal in IPsec for both ESP/IKE.</div>
<div><br>
</div>
<div>RFC 5996, says even if NATT is not detection sending IKE/ESP on 4500 is optional but receiving should be handled. </div>
<div>RFC 5666 reference:</div>
<div><i>"When either side is using port 4500, sending ESP with UDP encapsulation is</i></div>
<div><i> not required, but understanding received UDP-encapsulated ESP packets is required"</i></div>
<div><br>
</div>
<div>Having said that this all fine for IPv4, but for IPv6 is it possible that NATT is not detection and still IKE/ESP exchanges are done on port 4500 as UDP encapsulated.</div>
<div><br>
</div>
<div>One reference from RFC I can is below which says that IKE/ESP can always be on port 4500 even if NAT not detected, but not clear whether same is applicable for IPv6 as well.</div>
<div><i>" IKEv2 will use UDP encapsulation of IKE and ESP packets. This encoding is slightly less</i></div>
<div><i> efficient but is easier for NATs to process. In addition, firewalls</i></div>
<div><i> may be configured to pass UDP-encapsulated IPsec traffic but not plain, unencapsulated ESP/AH or vice versa."</i></div>
<div><br>
</div>
<div>Any opinion or suggestion for same will appreciated.</div>
<div><br>
</div>
<div>Thanks</div>
<div>Mukesh</div>
</div>
</div>
</div>
</span>
</body>
</html>