Re: [IPsec] IPsecME virtual interim meeting

Yoav Nir <ynir@checkpoint.com> Sun, 28 April 2013 06:55 UTC

Return-Path: <ynir@checkpoint.com>
X-Original-To: ipsec@ietfa.amsl.com
Delivered-To: ipsec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4015121F97FB for <ipsec@ietfa.amsl.com>; Sat, 27 Apr 2013 23:55:52 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.599
X-Spam-Level:
X-Spam-Status: No, score=-10.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u2uVVDioc37H for <ipsec@ietfa.amsl.com>; Sat, 27 Apr 2013 23:55:51 -0700 (PDT)
Received: from smtp.checkpoint.com (smtp.checkpoint.com [194.29.34.68]) by ietfa.amsl.com (Postfix) with ESMTP id 3804121F981B for <ipsec@ietf.org>; Sat, 27 Apr 2013 23:55:50 -0700 (PDT)
Received: from DAG-EX10.ad.checkpoint.com ([194.29.34.150]) by smtp.checkpoint.com (8.13.8/8.13.8) with ESMTP id r3S6tmRq031334; Sun, 28 Apr 2013 09:55:48 +0300
X-CheckPoint: {517CC6E1-1C-1B221DC2-1FFFF}
Received: from IL-EX10.ad.checkpoint.com ([169.254.2.54]) by DAG-EX10.ad.checkpoint.com ([169.254.3.48]) with mapi id 14.02.0342.003; Sun, 28 Apr 2013 09:55:48 +0300
From: Yoav Nir <ynir@checkpoint.com>
To: Yaron Sheffer <yaronf.ietf@gmail.com>
Thread-Topic: [IPsec] IPsecME virtual interim meeting
Thread-Index: AQHOQ2j7ZhGECxqyw0G6MTCqHW7GhZjrAbWA
Date: Sun, 28 Apr 2013 06:55:47 +0000
Message-ID: <8171432E-D286-437B-92AA-B193A38502B5@checkpoint.com>
References: <517C0490.9010600@gmail.com>
In-Reply-To: <517C0490.9010600@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [172.31.20.65]
x-kse-antivirus-interceptor-info: scan successful
x-kse-antivirus-info: Clean
x-cpdlp: 11f40b2ea577d5c221bf47f00b07c1f4efd9dec348
Content-Type: text/plain; charset="us-ascii"
Content-ID: <76E7E57C136396448FFB7129623DE0A2@ad.checkpoint.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: IPsecme WG <ipsec@ietf.org>
Subject: Re: [IPsec] IPsecME virtual interim meeting
X-BeenThere: ipsec@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Discussion of IPsec protocols <ipsec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ipsec>, <mailto:ipsec-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ipsec>
List-Post: <mailto:ipsec@ietf.org>
List-Help: <mailto:ipsec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipsec>, <mailto:ipsec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 28 Apr 2013 06:55:52 -0000

On Apr 27, 2013, at 8:02 PM, Yaron Sheffer <yaronf.ietf@gmail.com> wrote:

> Dear IPsec folks,
> 
> The ipsecme working group is chartered to come up with a solution for transporting long IKEv2 messages over networks that do not perform IP fragmentation correctly, and as a result drop overly long messages, usually IKE_AUTH messages.
> 
> Our original plan was to base the solution on IKE-over-TCP, however the author of this draft decided to abandon it because he now prefers a different solution, similar to the (non-standard) IKEv1 Fragmentation payload that was implemented by several vendors (see http://msdn.microsoft.com/en-us/library/cc233251.aspx). We do not want to end up with a common but non-standard solution in IKEv2, which would practically guarantee interoperability issues.

Just to set the record straight, I did not decide to abandon it, and if the group would like to pursue IKE-over-TCP I am willing to continue as editor. As a vendor, though, I would much rather implement just one mechanism that would work for both IKEv1 and IKEv2, and there is a huge installed base of IKEv1 with fragments.

 <snip/>

> We propose to meet May 7, at 9:00am PST (16:00 UTC, 12:00 noon EST, 19:00 Israel) for 1 hour. We will publish a bridge number a week before the meeting.
> 
> Please let us know if the date/time absolutely doesn't work for you.

This works for me.

Yoav