David, Thanks for the review. I am trying to understand the "interface" related comments that you made.
>Section 5.2 discusses the consequences of whether the endpoint >of an IPsec tunnel-mode SA is modeled as an IPv6 interface or >not. It should say that there is always an IPv6 interface at >the endpoint of a IPv6-in-IPv4 tunnel, and the discussion of >whether to model the SA as an interface is concerned with >whether the functionality of an IPv6 interface is realized by >the IPsec SA or outside of it. > In some implementations e.g., linux, to protect the traffic using IPsec tunnel mode SA, traffic matching the selectors is given to IPsec for protecting the traffic. IPsec is just another software module that is neither visible as an interface nor in the routing tables. By this it means that IPsec is not modeled as an interface at all. If in addition to the above, IPsec creates an interface and hence visible to routing so that it can get packets matching the route pointing to the interface rather than through "traffic selectors matching". By this it means that IPsec is modeled as an interface. These are the models that this document is talking about. So, how can we say that there is always an interface ? Could you clarify further ? -thanks mohan >It should also be stated that all uses of the word "interface" >refer to an IPv6 interface, and that the phrase "tunnel interface" >refers to an IPv6 interface at the endpoint of an IPv6-in-IPv4 >tunnel, independent of whether the tunnel is realized by IPsec >tunnel mode. The end of Section 1 would be a good place to >do this. The use of the phrase "IP interface" in Section A.1 >is considerably clearer than the use of "interface" without "IP" >n Section 5.2 - using "IP interface" throughout Section 5.2 >(and for that matter the entire draft) would improve readability. _______________________________________________ Gen-art mailing list [email protected] https://www1.ietf.org/mailman/listinfo/gen-art
