<?xml version='1.0'?>

<reference anchor='RFC2709'>

<front>
<title abbrev='Security for NAT Domains'>Security Model with Tunnel-mode IPsec for NAT Domains</title>
<author initials='P.' surname='Srisuresh' fullname='Pyda Srisuresh'>
<organization>Lucent technologies</organization>
<address>
<postal>
<street>4464 Willow Road</street>
<city>Pleasanton</city>
<region>CA</region>
<code>94588-8519</code>
<country>US</country></postal>
<phone>+1 925 737 2153</phone>
<facsimile>+1 925 737 2110</facsimile>
<email>srisuresh@lucent.com</email></address></author>
<date month='October' year='1999' />
<abstract>
<t>There are a variety of NAT flavors, as described in. Of the domains supported by NATs, only Realm-Specific IP clients are able to pursue end-to-end IPsec secure sessions. However, all flavors of NAT are capable of offering tunnel-mode IPsec security to private domain hosts peering with nodes in external realm. This document describes a security model by which tunnel-mode IPsec security can be architected on NAT devices. A section is devoted to describing how security policies may be transparently communicated to IKE (for automated KEY exchange) during Quick Mode. Also outlined are applications that can benefit from the Security Model described.</t></abstract></front>

<seriesInfo name='RFC' value='2709' />
</reference>
