Re: [IPsec] IPsecME virtual interim meeting (revised date)

["Valery Smyslov" <[e-mail]>]

Hi alll,

before the meeting I'd like to express some thoughts about the topic.

First, I think this is a very important problem. Untill we implemented
IKE fragmentation, many of our "road warrior" customers complained that
they couldn't use IPsec from public places, like hotels, restaraunts etc.
Such places often use cheap SOHO NAT boxes, that don't
pass IP fragments through.

Second, I (obviously) support draft-smyslov-ipsecme-ikev2-fragmentation
as solution for IKEv2, for the following reasons:

1. comparing with the non-standard IKEv1 mechanism it is more robust
    to DoS attacks (for the modest price), provides capability for PMTU 
discovery,
    well suited for IKEv2 and is IPR free. It is implemented and tested in 
fields.

2. IKE-over-TCP is an interesting solution, but, I think, it became too 
cumbersome
    as more details were considered. As usual, devil in details.

Regards,
Valery Smyslov.


> The ipsecme working group is chartered to come up with a solution for 
> transporting long IKEv2 messages over networks that do not perform IP 
> fragmentation correctly, and as a result drop overly long messages, 
> usually IKE_AUTH messages.
>
> We would like to invite the group to a Virtual Interim Meeting (a.k.a. 
> conference call), to discuss this problem.
>
> Potential outcomes of the meeting include:
> - The group decides that this is not an important problem.
> - This is an important problem and we have 1-2 people committed to author 
> a draft along the lines of the non-standard IKEv1 mechanism.
> - This is an important problem and the group is happy to adopt 
> draft-smyslov-ipsecme-ikev2-fragmentation (which solves the same problem 
> in a somewhat different fashion).
> - The group still prefers IKE-over-TCP and there are committed authors to 
> continue work on that draft.