Re: [dhcwg] Re: AD review of draft-ietf-dhc-dhcpv6-opt-prefix-delegation-03.txt

Thomas,

>> two options, either we remove the below paragraph altogether, and if
>> ever DHCP with IPsec gets defined elsewhere that would also apply to
>> these options, or we change the paragraph to say that if the
>> requesting and delegated routers have configured addresses or are
>> directly connected then IPsec may be used.
>
> IPsec can be used whenever  the two nodes have addresses and  can set
> up an SA between each . I don't see why one needs to mention anything
> beyond that (e.g, saying directly connected)

agree.

>>    Because a requesting router and delegating routers must each have
>>    at least one assigned IPv6 address, the routers may be able to use
>>    IPsec for authentication of DHCPv6 messages.  The details of using
>>    IPsec for DHCPv6 are under development.
>
> I'm OK with the "may". But (as I thought I'd mentioned before), the
> words "because a RR and DR must each have at least one assigned IPv6
> address" make me nervous because I'm not sure what is meant (or if
> something is meant that I don't think is correct).

just trying to say what you've so eloquently said below.

> If they mean addresses other than LL, that is not a
> requirement. Presumably this option can be used when booting and
> obtaining addresses, i.e., as DHC is intended to be used.
>
> Can you say something like:
>
>     If the requesting router and delegating routers have addresses
>     configured that allow them to communicate directly with each
>     other, they may be able to use IPsec for authentication of DHCPv6
>     messages.  The details of using IPsec for DHCPv6 are under
>     development.

yes, well put.

cheers,
Ole

_______________________________________________
dhcwg mailing list
dhcwg@ietf.org
https://www1.ietf.org/mailman/listinfo/dhcwg