Re: [IPsec] Some comments / questions on draft-ietf-ipsecme-ad-vpn-problem

Vishwas Manral <vishwas.ietf@gmail.com> Thu, 06 December 2012 23:52 UTC

Return-Path: <vishwas.ietf@gmail.com>
X-Original-To: ipsec@ietfa.amsl.com
Delivered-To: ipsec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5B09921F85EA for <ipsec@ietfa.amsl.com>; Thu, 6 Dec 2012 15:52:28 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.418
X-Spam-Level:
X-Spam-Status: No, score=-3.418 tagged_above=-999 required=5 tests=[AWL=0.180, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gCg9tLeA+-cy for <ipsec@ietfa.amsl.com>; Thu, 6 Dec 2012 15:52:27 -0800 (PST)
Received: from mail-qa0-f51.google.com (mail-qa0-f51.google.com [209.85.216.51]) by ietfa.amsl.com (Postfix) with ESMTP id 7D78D21E8040 for <ipsec@ietf.org>; Thu, 6 Dec 2012 15:52:27 -0800 (PST)
Received: by mail-qa0-f51.google.com with SMTP id i20so20203qad.10 for <ipsec@ietf.org>; Thu, 06 Dec 2012 15:52:27 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=be9R0mkaSreLhrluIj2ywxNSrtSraZfSEN7oq/fcanY=; b=Xefbm3ztzrnI3CaLR1NTA0+bnli5KsqpOHfwv8yUDFQdHVHyeODecvzqkJmPFCXV98 CMlxLrHeA6BzxCSmGFvEpkbSB9IVMb7oQk1YyMU3cGazDuFl33yo0p8Gm+LgYGb6Ff5D 6TtDHlYPX1/JjjewmaPVll+jfuu/0cQZzqOVlxeWdzleCmNDplCldWDvkWBAHnPR/dN7 /Uci9pRgQHP/IOn6LqKyAVWDbP34uI7AJDeYa5oGUWzQSJf9vcolHbroPda2DvD7VxgI 0xIbUC2o1tsMMTqcI1S7hvbBwS2zu2hjyiX3TniolGByxVSMyPyp40xsx6OZQIP7yBdj b5FQ==
MIME-Version: 1.0
Received: by 10.224.71.16 with SMTP id f16mr6084056qaj.45.1354837947035; Thu, 06 Dec 2012 15:52:27 -0800 (PST)
Received: by 10.229.92.77 with HTTP; Thu, 6 Dec 2012 15:52:26 -0800 (PST)
In-Reply-To: <CAOyVPHSJ2o_tGjMBKTepnGbEAZEHMBR6fijG8Fy6c7aMWxrDRw@mail.gmail.com>
References: <50A5703F.4070305@labn.net> <CAOyVPHTWhv8=sP6kYkZmOEsjMsdr72P8fe=7w5XY0Hd_wP_9=w@mail.gmail.com> <50A58CDB.30402@labn.net> <CAOyVPHQ+n83DaVv6Q9Z0kvi0MyYrhPbB=L6ju4fwjTyRK1P22Q@mail.gmail.com> <50A682F8.9080907@labn.net> <CAOyVPHSvWhgaYm2s_8_37VuaR1e_5tiJai+04AKzm3HXkNwESg@mail.gmail.com> <50A689A9.1090803@labn.net> <CAOyVPHR1euA9TRnAp7V+OKjRkPARYYvQ+C0HnA70y-122sy9ZQ@mail.gmail.com> <50A68D30.2040203@labn.net> <CAOyVPHR4OVNuvMU-UxZAJUoKFugCWwUQq0dSRo-7gY=Y886LoQ@mail.gmail.com> <CAOyVPHRopwvE5U3ZF7kDxNe59OgTk7ydoFG6iqvZdOFUCvaGyA@mail.gmail.com> <50BE30D9.4030903@labn.net> <CAOyVPHSXQQt_31Y2MP+iMe8d0MCxSyKzVvCLL-HLkcggaOKuMw@mail.gmail.com> <50BE4A60.1000303@labn.net> <CAOyVPHSkGVvGD2bMgk-vp3DO0o9N9Zt6mf4SnaL4L9ZFR8NRHg@mail.gmail.com> <50BFA4C0.1060909@labn.net> <CAOyVPHQu+NyQvxMjHJ0=0YtrH6rerU-etEmqQKTKP4jt4sHZgw@mail.gmail.com> <50BFCA9A.4030502@labn.net> <CAOyVPHQyVz0jCAFGdqLpCxE2tm5TBCkEXKLPBxigQasw=wNW9Q@mail.gmail.com> <50C0EEE9.7000904@labn.net> <CAOyVPHSJ2o_tGjMBKTepnGbEAZEHMBR6fijG8Fy6c7aMWxrDRw@mail.gmail.com>
Date: Thu, 06 Dec 2012 15:52:26 -0800
Message-ID: <CAOyVPHQ6q=FxOEWtQ3Rt3Pqobo+2q2frBMoqvfEH+k=0mm2wpw@mail.gmail.com>
From: Vishwas Manral <vishwas.ietf@gmail.com>
To: Lou Berger <lberger@labn.net>
Content-Type: multipart/alternative; boundary="bcaec51b1b978fb1af04d037ca0d"
Cc: IPsecme WG <ipsec@ietf.org>
Subject: Re: [IPsec] Some comments / questions on draft-ietf-ipsecme-ad-vpn-problem
X-BeenThere: ipsec@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Discussion of IPsec protocols <ipsec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ipsec>, <mailto:ipsec-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ipsec>
List-Post: <mailto:ipsec@ietf.org>
List-Help: <mailto:ipsec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipsec>, <mailto:ipsec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 06 Dec 2012 23:52:28 -0000

Sorry. Here it is with the right file.

-Vishwas

On Thu, Dec 6, 2012 at 3:51 PM, Vishwas Manral <vishwas.ietf@gmail.com>wrote:

> Hi Lou,
>
> Here is the latest draft, with all your comments incorporated.
>
> I will post the draft soon.
>
> Thanks,
> Vishwas
>
>
>
> On Thu, Dec 6, 2012 at 11:15 AM, Lou Berger <lberger@labn.net> wrote:
>
>>
>> Vishwas,
>>
>> I think I see where you're headed.
>>
>> The text under discussion is:
>>
>>    Routing using the tunnels SHOULD work
>>    seamlessly without any updates to the higher level application
>>    configuration i.e.  OSPF configuration, when the tunnel parameter
>>    changes.
>>
>> I read this a requirement being placed on the higher level protocol, but
>> I believe your intent was on the solution.  How about rephrasing along
>> the lines of a requirement on the ADVPN solution? Perhaps something like:
>>
>>    The ADVPN solution SHOULD NOT increase the amount of information
>>    required to configure protocols running over IPsec tunnels.
>>
>> Lou
>>
>> On 12/6/2012 1:55 PM, Vishwas Manral wrote:
>> > Hi Lou,
>> >
>> > I have included the other comments. The last one remaining is:
>> >
>> >     > VM> I think this is an important requirement. A tunnel should be
>> >     able to
>> >     > provide an interface by which when tunnel IP parameters change we
>> >     do not
>> >     > have to change any configuration for higher application like
>> >     Routing. I
>> >     > had earlier mentioned in more generic terms earlier but changed
>> to the
>> >     > terms provided based on feedback from the list.
>> >
>> >     What higher level protocols like most routing protocols that use the
>> >     tunnel interface IP addresses in operation?
>> >
>> >     >
>> >     > The entire idea is the with scale configuration needs to be
>> >     reduced and
>> >     > that needs to happen across layers, so every layer needs to
>> >     provide the
>> >     > service. Let me know what it is I am unable to convey.
>> >
>> >     sure, but I think you're placing new requirements on the routing &
>> >     tunneling protocols.
>> >
>> > VM> There are no restrictions on an application protocol like Routing.
>> > The idea is that the lower needs to provide a functionality, so that if
>> > required a higher layer can use it. There is no restriction at all on
>> > the higher layer. Do let me know if that is clearer?
>> >
>> > Thanks,
>> > Vishwas
>> >
>> >
>> > _______________________________________________
>> > IPsec mailing list
>> > IPsec@ietf.org
>> > https://www.ietf.org/mailman/listinfo/ipsec
>> >
>>
>
>