IPsec tunnel mode
Click on the red underlined text to get to the source
... the requirements for host configuration in IPsec tunnel mode, and
describes how DHCPv4 may be leveraged for configuration.
...
... IPsec tunnel mode configuration requirements ...
... requirements of a host with
an IPsec tunnel mode interface include the need to obtain an IPv4
address and other configuration parameters ...
...
Leveraging DHCP for configuration of IPsec tunnel mode meets the
basic requirements described in [21 ...
... IPv4, leveraging DHCPv4 [3] for the configuration of IPsec
tunnel mode satisfies the basic requirements described in [21].
...
... authentication [5] is required, this can be
supported on an IPsec tunnel mode interface as it would be on
any other interface ...
... requirements, nor does it provide the additional capabilities. As a
result, DHCPv4 is the superior alternative for IPsec tunnel mode
configuration.
...
... interfaces are used in the outer and inner headers of the
IPsec tunnel mode packet, respectively.
...
... The configuration of the intranet interface of the IPsec tunnel mode
host is accomplished in the following steps:
...
... remote host establishes a DHCP SA with the IPsec tunnel mode
server in a quick mode exchange. The DHCP ...
... quick mode exchange. The DHCP SA is an IPsec tunnel
mode SA established to protect initial DHCPv4 traffic ...
... htype 1 Hardware address type. Set to value 31.
signifying an IPsec tunnel mode virtual interface.
hlen 1 Hardware address ...
... DHCP message
The htype value is set to the value 31, signifying a virtual IPsec
tunnel mode interface, in order to enable the DHCP server to
...
... the security gateway (acting as a DHCP Relay) using the IPsec tunnel
mode SA, including DHCPOFFER, DHCPACK ...
...
This document requires that an htype value be allocated for use with
IPsec tunnel mode, as described in section 4.1. Note that DHCP
relies on the arp-parameters registry ...