Abstract
Applying IPSec in NAT-PT environment for end-to-end security fails due to the problems caused by the IP header conversion in NAT-PT server. The IP header conversion causes the receiver to fail to verify the TCP/UDP checksum and the ICV value of the AH header. This study analyses potential problems in applying the IPSec between the IPv6-only node and an IPv4-only node, and proposes a solution to enable the receiver successfully ver-ify the IPSec packet. We also analyze that why the existing NAT-traversal so-lutions in IPv4 fails in NAT-PT environment.
This is a preview of subscription content, log in via an institution to check access.
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Tsirtsis, G., Srisuresh, P.: Network Address Translation Protocol Translation (NAT-PT), RFC 2766, 2 (2000)
Satapati, S.: NAT-PT Applicability, draft-satapati-v6ops-natpt-applicability-00 (October 2003)
Egevang, K., Francis, P.: The IP Network Address Translator (NAT), RFC 1631, 5 (1994)
Kivinen, T.: Negotiation of NAT-Traversal in the IKE, draft-ietf-IPSec-nat-t-ike-08 (February 2004)
Huttunen, A., et al.: UDP Encapsulation of IPSec Packets, draft-ietf-IPSec-udp-encaps-6.txt (January 2003)
Montenegro, G., Borella, M.: RSIP Support for End-to-end IPSec, RFC 3104 (October 2001)
Nordmark, E.: Stateless IP/ICMP Translation Algorithm (SIIT), RFC 2765 (February 2000)
Kent, S., Atkinson, R.: Security Architecture for the Internet Protocol, RFC 2401 (November 1998)
Kent, S., Atkinson, R.: IP Encapsulating Security Payload (ESP), RFC 2406 (November 1998)
Kent, S., Atkinson, R.: IP Authentication Header, RFC 2402 (November 1998)
Harkins, D., Carrel, D.: The Internet Key Exchange (IKE), RFC 2409 (November 1998)
Aboba, B., et al.: IPSec-Network Address Translation (NAT) Compatibility Requirements, RFC 3715 (March 2004)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2005 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Jung, S., Choi, J., Kim, Y., Kim, S. (2005). IPSec Support in NAT-PT Scenario for IPv6 Transition. In: Zhou, J., Lopez, J., Deng, R.H., Bao, F. (eds) Information Security. ISC 2005. Lecture Notes in Computer Science, vol 3650. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11556992_14
Download citation
DOI: https://doi.org/10.1007/11556992_14
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-29001-8
Online ISBN: 978-3-540-31930-6
eBook Packages: Computer ScienceComputer Science (R0)