API Build-data JSON Resources
Theme

Choose how MSRBot.io looks on this device.

Auto (match system) Light mode Dark mode

Preference is stored in this browser only.

IETF RFC 3884
[ACTIVE]

Use of IPsec Transport Mode for Dynamic Routing

Metadata

Publisher
IETF
Doc Type
Informational
Pages
25
Abstract
IPsec can secure the links of a multihop network to protect communication between trusted components, e.g., for a secure virtual network (VN), overlay, or virtual private network (VPN). Virtual links established by IPsec tunnel mode can conflict with routing and forwarding inside VNs because IP routing depends on references to interfaces and next-hop IP addresses. The IPsec tunnel mode specification is ambiguous on this issue, so even compliant implementations cannot be trusted to avoid conflicts. An alternative to tunnel mode uses non-IPsec IPIP encapsulation together with IPsec transport mode, which we call IIPtran. IPIP encapsulation occurs as a separate initial step, as the result of a forwarding lookup of the VN packet. IPsec transport mode processes the resulting (tunneled) IP packet with an SA determined through a security association database (SAD) match on the tunnel header. IIPtran supports dynamic routing inside the VN without changes to the current IPsec architecture. IIPtran demonstrates how to configure any compliant IPsec implementation to avoid the aforementioned conflicts. IIPtran is also compared to several alternative mechanisms for VN routing and their respective impact on IPsec, routing, policy enforcement, and interactions with the Internet Key Exchange (IKE). This memo provides information for the Internet community.
Publication Date
2004-09-01
Status Note
Informational
DOI
10.17487/RFC3884
Link
https://doi.org/10.17487/RFC3884
Author(s)
Dr. Joseph D. Touch
Lars Eggert
Yu-Shun Wang
Latest version of IETF RFC 3884

Document Versions — IETF RFC 3884

  • ▶ IETF RFC 3884 (2004-09-01)
    THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

  • Touch, J., "Dynamic Internet overlay deployment and management using the X-Bone", Computer Networks Vol. 36, No. 2-3, July 2001. EXTERNAL
  • Touch, J., Wang, Y., Eggert, L. and G. Finn, "A Virtual Internet Architecture", ISI Technical Report ISI-TR-570, Workshop on Future Directions in Network Architecture (FDNA) 2003, March 2003. EXTERNAL
  • IETF RFC 1122 [Active*]
  • IETF RFC 2003 [Active*]
  • IETF RFC 2107 [Active*]
  • IETF RFC 2401 [Superseded*]
  • IETF RFC 2402 [Superseded*]
  • IETF RFC 2406 [Superseded*]

Bibliographic Reference(s)

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC3884.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree
Reference this Doc

Plain text (ISO 690 compliant)

Preview:
IETF RFC 3884, Use of IPsec Transport Mode for Dynamic Routing. Available at https://doi.org/10.17487/RFC3884
Snippet:
IETF RFC 3884, Use of IPsec Transport Mode for Dynamic Routing. Available at https://doi.org/10.17487/RFC3884

HTML (ISO 690 compliant)

Preview:
IETF RFC 3884, Use of IPsec Transport Mode for Dynamic Routing. Available at https://doi.org/10.17487/RFC3884
Snippet:
<span class="citation"><cite>IETF RFC 3884</cite>, Use of IPsec Transport Mode for Dynamic Routing. Available at <a href="https://doi.org/10.17487/RFC3884" target="_blank" rel="noopener">https://doi.org/10.17487/RFC3884</a></span>

SMPTE Icon SMPTE's HTML Pub

Preview:
IETF RFC 3884, Use of IPsec Transport Mode for Dynamic Routing
doi: 10.17487/RFC3884
url: https://doi.org/10.17487/RFC3884
Snippet:
<li>
<cite id="bib-rfc3884">IETF RFC 3884</cite>, Use of IPsec Transport Mode for Dynamic Routing
<span class="doi">10.17487/RFC3884</span>
</li>

Referenced By