Useful versus not useful round 2!

[vulgarcriminal.livejournal.com]

Useful:
- Telling me you need to tunnel into the company's network.
- Telling me you might bring some laptops. By some, I mean 14.

Not useful:
- Well, not telling me.

God damn it. It's now 2:30 and I have no idea what I'm setting up for tomorrow.

Also, does NAT Traversal add a second IP header with originating IP and NAT'd IP and new checksum? I'm arguing with my manager about this.

I thought that was how it worked but now I am not so sure.

Edit: ALSO, new logic FTW!

How does it work that shipping 14 pre-configured laptops around the country with your VPN software installed is more cost effective than just sending it to us or having your instructor install it on the day?

Comments

[insaint.livejournal.com]

I *think* NAT traversal just modifies the IP that's in the headers, but don't quote me on that.

[vulgarcriminal.livejournal.com]

I thought it added a second header to the encrypted packet with the originating IP and the NAT'd IP since a firewall wouldn't be able to read the encrypted header. I don't know though. It is new!

[spooforbrains.livejournal.com]

Doesn't the encryption happen on a higher level than IP? My knowledge of networking is on a level with my knowledge of quantum physics, but I'm pretty sure that the IP headers* themselves are not encrypted, or how would the routing machines know where to deliver them?

* this may not be the correct terminology

[vulgarcriminal.livejournal.com]

I'm really fuzzy on L2TP/IPSec but I thought in transport mode the IP header was unencrypted, while the payload was. But in tunnel mode the whole packet, IP header included is encrypted, which is why IPSec in tunnel mode packets can't be NAT'd.

Honestly though, the IPSec portion of the networking certs I've done made my brain go WOM WOM WOM.

[superbus.livejournal.com]

I'm 99.9% sure that you're correct. All a NAT is in the first place is a translation; it doesn't have to know what the other side is. So from my experiences with Nortel VPN systems (what we run where I work), all that matters is the NATted IP; the internal, as long as your NAT is correct on the router, is irrelevant.

[vulgarcriminal.livejournal.com]

It is relevant to IPSec tunnels though. If the encryption of the IP header of the packet didn't matter, then IPSec tunnel packets would NAT no problem. But they don't.

[travisd.livejournal.com]

How does it work that shipping 14 pre-configured laptops around the country with your VPN software installed is more cost effective than just sending it to us or having your instructor install it on the day?

...because if they don't, then THEIR techsupport people will be posting here complaining about how incompetent their instructors are, and how non-standard your systems must me to not work with their software. :)

[zorikin.livejournal.com]

NAT traversal adds a second IP header in tunnel mode but not in transport mode. The different stacks are illustrated in RFC3948, sections 3.2 and 3.4: http://www.ietf.org/rfc/rfc3948.txt

[spooforbrains.livejournal.com]

/me makes mental note to read and completely fail to understand this document

[vulgarcriminal.livejournal.com]

That's what I thought! HA.
:)