(racoon 857) Re: Racoon NAT-T Transport Mode

On Thu, 4 Nov 2004, Derek Atkins wrote:

> Quoting Michal Ludvig <[email protected]>:
> 
> > On Thu, 4 Nov 2004, Emmanuel Dreyfus wrote:
> > 
> > > Michal Ludvig <[email protected]> wrote:
> > > 
> > > > IPsec-tools racoon doesn't support NAT-OA payload that is required for
> > > > transport mode byt the standard. It is quite some time since I wrote the
> > > > NAT-T support so I'm not sure how much work would it be to add it...
> > > 
> > > Not that much, IMO. Implementing OA will also make possible to use
> > > multiple machines from behind a NAT.
> > 
> > I doubt it will help on Linux. It is missing OA handling at all (you 
> > can pass it to the kernel but the structure is never used).
> > 
> > BTW Having multiple clients behind a NAT doesn't work in Tunnel mode? 
> > But for Tunnel mode NAT-OA isn't transmitted anyway (as written in RFC).
> > 
> > Michal Ludvig
> 
> NAT-OA is ignored by the Linux Kernel because it internally recomputes (or,
> rather, just ignores) the checksum, so you don't need it.  If it passes through
> the IPsec checks it marks the packet "checksum ok" so the IP address is not
> needed from the OA packet.

I see, I didn't know it.

> The IKE daemon should still transmit (and accept) it, however.

I hope I'll have time in the near future to add it.

Michal Ludvig
-- 
* A mouse is a device used to point at the xterm you want to type in.
* Personal homepage - http://www.logix.cz/michal