Re: Can IPSec ESP be nested in another ESP?

the protocol have essentially allows it. The problem is the ipsec
implementation on the PC side: it is quite hard to get it right and not
mixup the 2 tunnels. So essentially a good ipsec implementation should
work, but i have to tell you that most of them dont. Depends on the
vendor and the way they implemented it.

J.

On Tue, Sep 28, 2004 at 09:52:59AM +0200, Son Phan wrote:
> Hello,
> 
> I understand that AH & ESP mode can be applied together for the same 
> IP packet.
> 
> However I don't know whether two ESP can be nested. The case is as 
> below:
> 
> PC-------------------------------VPN GW-------------Application Server (AS)
> <<------ESP tunnel mode----->>
> <<-------------ESP transport mode ------------------->>
> 
> PC has remote access to some closed domain using via VPN GW. ESP 
> tunnel mode is used here.
> One of the application running on this PC want to use a service provided 
> by an AS within this closed domain. However this service mandates the 
> client to use ESP transmode mode to contact it.
> 
> Can this scenario works?
> Any extra requirement toward the IPSec implementation on PC?
> 
> Thanks, Son
>  
> _______________________________________________
> VPN mailing list
> [email protected]
> http://lists.shmoo.com/mailman/listinfo/vpn

-- 
--

-> Jean-Francois Dive
--> [email protected]

  I think that God in creating Man somewhat overestimated his ability.
    -- Oscar Wilde