(usagi-users 02247) Re: IPSec over TCP

[Peter Bieringer <pb@xxxxxxxxxxxx>]

Hi,

I got a reply from Check Point.


Regarding to the IKE over TCP issue:

they use the also to IKE assigned port 500/tcp without any known protocol
differences. Reason was the existance of lame NAT devices that do not
handle well fragmented UDP packets.

Sure the same was the reason for implementing the feature also in the Cisco
VPN concentrator.

For IPv6: no need to implement, because here we have no NAT and
fragmentation will be handled per link.

General: can be discussed whether pluto is also able to listen on 500/tcp
by control switch.


        Peter
-- 
Dr. Peter Bieringer                     http://www.bieringer.de/pb/
GPG/PGP Key 0x958F422D               mailto: pb at bieringer dot de 
Deep Space 6 Co-Founder and Core Member  http://www.deepspace6.net/