Re: [IPsec] IPsecME virtual interim meeting

Yoav Nir <> Sun, 28 April 2013 06:55 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 4015121F97FB for <>; Sat, 27 Apr 2013 23:55:52 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -10.599
X-Spam-Status: No, score=-10.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id u2uVVDioc37H for <>; Sat, 27 Apr 2013 23:55:51 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 3804121F981B for <>; Sat, 27 Apr 2013 23:55:50 -0700 (PDT)
Received: from ([]) by (8.13.8/8.13.8) with ESMTP id r3S6tmRq031334; Sun, 28 Apr 2013 09:55:48 +0300
X-CheckPoint: {517CC6E1-1C-1B221DC2-1FFFF}
Received: from ([]) by ([]) with mapi id 14.02.0342.003; Sun, 28 Apr 2013 09:55:48 +0300
From: Yoav Nir <>
To: Yaron Sheffer <>
Thread-Topic: [IPsec] IPsecME virtual interim meeting
Thread-Index: AQHOQ2j7ZhGECxqyw0G6MTCqHW7GhZjrAbWA
Date: Sun, 28 Apr 2013 06:55:47 +0000
Message-ID: <>
References: <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
x-originating-ip: []
x-kse-antivirus-interceptor-info: scan successful
x-kse-antivirus-info: Clean
x-cpdlp: 11f40b2ea577d5c221bf47f00b07c1f4efd9dec348
Content-Type: text/plain; charset="us-ascii"
Content-ID: <>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: IPsecme WG <>
Subject: Re: [IPsec] IPsecME virtual interim meeting
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Discussion of IPsec protocols <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sun, 28 Apr 2013 06:55:52 -0000

On Apr 27, 2013, at 8:02 PM, Yaron Sheffer <> wrote:

> Dear IPsec folks,
> The ipsecme working group is chartered to come up with a solution for transporting long IKEv2 messages over networks that do not perform IP fragmentation correctly, and as a result drop overly long messages, usually IKE_AUTH messages.
> Our original plan was to base the solution on IKE-over-TCP, however the author of this draft decided to abandon it because he now prefers a different solution, similar to the (non-standard) IKEv1 Fragmentation payload that was implemented by several vendors (see We do not want to end up with a common but non-standard solution in IKEv2, which would practically guarantee interoperability issues.

Just to set the record straight, I did not decide to abandon it, and if the group would like to pursue IKE-over-TCP I am willing to continue as editor. As a vendor, though, I would much rather implement just one mechanism that would work for both IKEv1 and IKEv2, and there is a huge installed base of IKEv1 with fragments.


> We propose to meet May 7, at 9:00am PST (16:00 UTC, 12:00 noon EST, 19:00 Israel) for 1 hour. We will publish a bridge number a week before the meeting.
> Please let us know if the date/time absolutely doesn't work for you.

This works for me.