ipsec的 AH/ESP & Tunnel/trasnport

讀ipsec N年了, 讀了就忘, 該是有個了結

http://tools.ietf.org/html/draft-bhatia-moving-ah-to-historic-00.html
AH能做的看來 ESP都OK,所以說bye吧

http://blog.ine.com/2010/05/28/when-transport-mode-becomes-tunnel-mode-free-of-charge/

大多數的環境都不會用transport mode(你知道juniper SRX完全不支援transport mode嗎?)
因為transport mode只會protected ipsec peer的IP

所以, 只搞定ESP+tunnel mode應該就夠了

另外IPSec 是直接跑在IP上的,  PAT+IPsec要有怪招才行, 每家功能都不一樣(ALG?)

• IP Protocol ID of 50 (0x32) for IPSec Encapsulating Security Payload (ESP) traffic
  
• IP Protocol ID of 51 (0x33) for IPSec Authentication Header (AH) traffic