Re: v6-in-v4 IPsec and NAT traversal

[Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>]

Pekka Savola <pekkas@xxxxxxxxxx> wrote:
> 
> Is this planned?  Are there issues with "native" support why it would 
> not be feasible?

http://www.spinics.net/lists/linux-net/msg08197.html

> Avoiding double encapsulation would be IMHO really useful, and several 
> other implementations are already reported to allow this.

There is no double encapsulation.  Using an SIT tunnel inside a
transport v4 SA is equivalent to a v6/v4 SA in terms of overhead.

However, you do lose the ability to negotiate the selector but
you can always use netfilter to fix it up.
-- 
Debian GNU/Linux 3.0 is out! ( http://www.debian.org/ )
Email:  Herbert Xu ~{PmV>HI~} <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt