tunnel
Click on the red underlined text to get to the source
... the requirements for host configuration in IPsec tunnel mode, and
describes how DHCPv4 may be leveraged for configuration.
...
... IPsec tunnel mode configuration requirements ...
... requirements of a host with
an IPsec tunnel mode interface include the need to obtain an IPv4
address and other configuration parameters ...
...
Leveraging DHCP for configuration of IPsec tunnel mode meets the
basic requirements described in [21 ...
... IPv4, leveraging DHCPv4 [3] for the configuration of IPsec
tunnel mode satisfies the basic requirements described in [21].
...
... DHCP server, not within the IKE implementation. As
a result, the loss of a tunnel server does not result in the
loss of configuration and addressing state ...
... authentication [5] is required, this can be
supported on an IPsec tunnel mode interface as it would be on
any other interface ...
... requirements, nor does it provide the additional capabilities. As a
result, DHCPv4 is the superior alternative for IPsec tunnel mode
configuration.
...
... security gateway,
using IPsec tunnel mode. This host is then configured in such a
manner so as to provide it with a virtual presence on the internal
...
... security gateway
and then establish an IPsec tunnel to it. The remote host then
interacts via the IPsec ...
... remote host then
interacts via the IPsec tunnel with a DHCPv4 server which provides
the remote host ...
... the host's original, routable IP address as the tunnel endpoint. The
virtual identity assumed by the remote host ...
... interfaces are used in the outer and inner headers of the
IPsec tunnel mode packet, respectively.
...
... The configuration of the intranet interface of the IPsec tunnel mode
host is accomplished in the following steps:
...
... remote host establishes a DHCP SA with the IPsec tunnel mode
server in a quick mode exchange. The DHCP ...
... quick mode exchange. The DHCP SA is an IPsec tunnel
mode SA established to protect initial DHCPv4 traffic ...
... DHCP messages will be carried over a new IPsec tunnel.
Alternatively, the remote host and the security gateway ...
... tunnel is required, the remote host establishes a
tunnel mode SA to the security gateway in a quick mode exchange.
...
... htype 1 Hardware address type. Set to value 31.
signifying an IPsec tunnel mode virtual interface.
hlen 1 Hardware address ...
... DHCP message
The htype value is set to the value 31, signifying a virtual IPsec
tunnel mode interface, in order to enable the DHCP server to
...
... subnet provided that the remote host only
brings up a single tunnel to the security gateway. Where a LAN
...
... DHCPDISCOVER or DHCPREQUEST) is then tunneled to the security
gateway using the tunnel mode SA. Note that since the DHCPDISCOVER
packet has a broadcast ...
... remote host on the
correct IPsec tunnel, without having to keep state gleaned from the
DISCOVER, such as a table of the xid, chaddr and tunnel ...
... tunnel, without having to keep state gleaned from the
DISCOVER, such as a table of the xid, chaddr and tunnel.
If the security gateway ...
... subnet for each IPsec
tunnel, then this can be accomplished by inserting the appropriate
interface address ...
...
Where allocating a separate subnet for each tunnel is not feasible,
and the DHCP server does not support the Relay Agent Information
Option ...
... Relay Agent behavior will not be possible. In such
cases, implementations MAY devise a mapping between the xid, chaddr,
and tunnel in order to route the DHCP server response to the
...
... route the DHCP server response to the
appropriate tunnel endpoint. Note that this is particularly
undesirable in large VPN servers where the resulting state ...
... the security gateway (acting as a DHCP Relay) using the IPsec tunnel
mode SA, including DHCPOFFER, DHCPACK ...
...
This document requires that an htype value be allocated for use with
IPsec tunnel mode, as described in section 4.1. Note that DHCP
relies on the arp-parameters registry ...
... mutual authentication of the IPsec
tunnel endpoints, it is difficult to integrate IKECFG with
DHCPv4 authentication ...