Re: Can IPSec ESP be nested in another ESP?

Son,

I know that Checkpoint was talking about having an ability like that 
with their client (encrypt/decrypt/then automatically re-encrypt by 
policy), but I don't know if they have implemented it.

It seems like you could have people use their IPSec client through a b2b 
tunnel easily enough though.  So:


Users ------> firewall <--------IPSEC 
tunnel------->firewall------>application server---------->target app

|---Site A------------| <--------  Internet ---------->| <-------  Site 
B-----------------------------------|

Users w/IPSec client -----------------------------------------------| 
terminate client tunnel --> hit target app


The users would ride the b2b tunnel through to the application server.  
It seems a little bit like overkill though.  I don't  know your specific 
situation, but you could just as easily have a firewall rule allowing 
IPSec clients in to your application server.

Good luck!

--Travis


 
Son Phan wrote:

>Hello,
>
>I understand that AH & ESP mode can be applied together for the same 
>IP packet.
>
>However I don't know whether two ESP can be nested. The case is as 
>below:
>
>PC-------------------------------VPN GW-------------Application Server (AS)
><<------ESP tunnel mode----->>
><<-------------ESP transport mode ------------------->>
>
>PC has remote access to some closed domain using via VPN GW. ESP 
>tunnel mode is used here.
>One of the application running on this PC want to use a service provided 
>by an AS within this closed domain. However this service mandates the 
>client to use ESP transmode mode to contact it.
>
>Can this scenario works?
>Any extra requirement toward the IPSec implementation on PC?
>
>Thanks, Son
> 
>_______________________________________________
>VPN mailing list
>[email protected]
>http://lists.shmoo.com/mailman/listinfo/vpn
>
>
>  
>