Re: Can IPSec ESP be nested in another ESP?

i had a client set something very similar to this but they used a 
hardware VPN in conjuction with a software IPSEC Client for the PC.

IPSEC_PC--(VPNGW)------------(VPNGW)------------AppServer
                  <--tunnel-->
<-------------------------transport------------>


please correct me if i am wrong but i don't think you can run 2 IPSec 
clients on a PC. by default both applications would be listening on UDP 500.

one possible, long shot, solution would be to force the communication 
b/w your VPNGW and PC to use a diff IKE port and also use UDP 
encapsulation. communication b/w PC and App server would not be modified 
at all.

good luck


-- 
clint
Cryptek, Inc.



Son Phan wrote:
> Hello,
> 
> I understand that AH & ESP mode can be applied together for the same
> IP packet.
> 
> However I don't know whether two ESP can be nested. The case is as
> below:
> 
> PC-------------------------------VPN GW-------------Application Server (AS)
> <<------ESP tunnel mode----->>
> <<-------------ESP transport mode ------------------->>
> 
> PC has remote access to some closed domain using via VPN GW. ESP
> tunnel mode is used here.
> One of the application running on this PC want to use a service provided
> by an AS within this closed domain. However this service mandates the
> client to use ESP transmode mode to contact it.
> 
> Can this scenario works?
> Any extra requirement toward the IPSec implementation on PC?
> 
> Thanks, Son
>  
> _______________________________________________
> VPN mailing list
> [email protected]
> http://lists.shmoo.com/mailman/listinfo/vpn
>