Re: [IPsec] Fwd: FW: I-D Action:draft-xu-ike-sa-sync-00.txt

Hi, Yoav:

Firstly, thanks a lot for your comments. Please check my words in-line below:

> Looks like we have a lot of drafts lately dealing with crash recovery:
> IFARE, QCD, SIR, and now yours (in chronological order).
>
> Specifically, it looks like your proposal is competing with the IFARE
> proposal:
> http://www.ietf.org/internet-drafts/draft-sheffer-ipsec-failover-03.txt
[Peny] Well, considering problem of the IPsec failover, some operator
may need a stateful network-centric solution.

> You may want to post to the list some cons/pros of your proposal vs
> ipsec-failover.
[Peny] Just as I mentioned above, this solution is about a stateful
network-centric one to solve the problem of IPsec failover. Especially
when we consider the possibility that the IPsec client may be cracked,
our solution can be an useful alternative for operators. It only
incurs a very small extension on the base IKEv2 protocol.
And, I agree that our solution may need to be improved for the cases
when the mobile IPsec client does the IKE SYNC during handover. But,
such kind of cases are quite unusual. We will make the improvement in
the following updates.

> Specific comments about the draft:
>  - I think you should add a specific description about how keys are derived
> with a successful stub lookup
>  - I think you should remove the text that deals with internal structure
> (and the use of STL). We only need to know what the gateway should be able
> to look up
>  - I'm not sure I understand section 3.6.  I understand the format of the
> SYN payload, but I don't get the stub-related signaling.  Are you specifying
> the signaling protocol between the gateways, or is that left as a local
> matter?  Is interoperability between different vendor's gateways a goal of
> this specification?
[Peny] Thank you very much for your comments. We will update our draft
based on your comments within next week.

Thank you again for your help.

BRG
Peny

>
> On Jul 7, 2008, at 12:05 PM, Peny Yang wrote:
>
> >
> > Hi, folks:
> >
> > We have submitted the draft on IKEv2 SA synchronization. Please check it.
> > Comments are more than welcome.
> >
> > And, if possible, I would like to apply for a slot to present our work
> > in the incoming IPsec WG meeting in Dublin.
> >
> > Thanks a lot
> > BRG
> > Peny
> >
> >
> >
> >
> > >
> > > > -----Original Message-----
> > > > From: i-d-announce-bounces@ietf.org
> > > >
> > >
> > [mailto:i-d-announce-bounces@ietf.org]
> >
> > >
> > > > On Behalf Of Internet-Drafts@ietf.org
> > > > Sent: Monday, July 07, 2008 4:30 PM
> > > > To: i-d-announce@ietf.org
> > > > Subject: I-D Action:draft-xu-ike-sa-sync-00.txt
> > > >
> > > > A New Internet-Draft is available from the on-line Internet-Drafts
> > > > directories.
> > > >
> > > >   Title           : IKE SA Synchronization
> > > >   Author(s)       : Y. Xu, et al.
> > > >   Filename        : draft-xu-ike-sa-sync-00.txt
> > > >   Pages           : 17
> > > >   Date            : 2008-07-07
> > > >
> > > > It will take a long time to do security association syncronization
> > > > among IKE/IPsec gateways possibly maintaining huge numbers of IKEv2/
> > > > IPsec SAs.  The major reason is that the prcocedure of IKEv2 SA re-
> > > > establishment will incur a time-consuming computation especially in
> > > > the Diffie-Hellman exchange.  In this draft, a new IKE security
> > > > associations synchronization solution is proposed to reduce the
> > > > computation by directly transferring the indexed IKE SA from old
> > > > gateway to new gateway, wherein the most expensive Diffie-Hellman
> > > > calculation can be avoided.  Without some time-consuming IKEv2
> > > > exchanges, the huge amount of IKE/IPsec SA synchronization procedures
> > > > can be finished in a short time.
> > > >
> > > > A URL for this Internet-Draft is:
> > > >
> http://www.ietf.org/internet-drafts/draft-xu-ike-sa-sync-00.txt
> > > >
> > > > Internet-Drafts are also available by anonymous FTP at:
> > > > ftp://ftp.ietf.org/internet-drafts/
> > > >
> > > > Below is the data which will enable a MIME compliant mail reader
> > > > implementation to automatically retrieve the ASCII version of the
> > > > Internet-Draft.
> > > >
> > >
> >
> >
> > Scanned by Check Point Total Security Gateway.
> >
> <draft-xu-ike-sa-sync-00.txt>_______________________________________________
> > IPsec mailing list
> > IPsec@ietf.org
> > https://www.ietf.org/mailman/listinfo/ipsec
> >
>
>
_______________________________________________
IPsec mailing list
IPsec@ietf.org
https://www.ietf.org/mailman/listinfo/ipsec