Where NAT disenfranchises the end-user ...
RJ Atkinson
rja at inet.org
Mon Sep 10 18:06:14 UTC 2001
At 13:47 10/09/01, Richard Welty wrote:
>in the case of IPSec, the IP addresses need to be preserved end-to-end
>as part of the whole security scheme.
True, but ONLY because the Internet Architecture lacks an alternative
namespace that could identify the box associated with a given network
interface. (The IP address is used in this context to identify the network
interface associated with the Security Association). So that's all true
today, but is driven by a shortcoming in the Internet Architecture.
Ran
rja at Inet.org
More information about the NANOG
mailing list