Le mer 07/07/2004 à 23:42, Antony Stone a écrit : > Also, if you can do transport mode with ESP, then it should work through NAT > without problems, because the original packet gets encapsulated (as per my > previous explanation). Nope. Only ESP tunnel mode can go through NAT. The main difference between transport mode and tunnel is that tunnel encapsulate the whole IP packet when transport mode only encapsulate IP payload only (for IP destination and IPSEC destination are the same). If you try to do NAT, then you will modify IP header, and then TCP checksum, which is ciphered will get false for it also include IP adresses in its calculation. -- http://www.netexit.com/~sid/ PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE >> Hi! I'm your friendly neighbourhood signature virus. >> Copy me to your signature file and help me spread!
