[MBONED] Fwd: Re: [pim] PIM and IPsec experience

[Stig Venaas <[e-mail]>]

Dear mboned, are you aware of deployments of PIM-SM using IPsec?
In particular deployments using a mix of PIM-SM implementations.

Stig

-------- Forwarded Message --------
Subject: Re: [pim] PIM and IPsec experience
Date: Tue, 10 Mar 2015 12:31:16 -0400
From: Brian Haberman <[e-mail]>
To: [e-mail]

All,

On 3/10/15 12:23 PM, Jeffrey (Zhaohui) Zhang wrote:
> Lab testing can provide data on interoperability, but what about deployment experiences?

Deployment experience is key.  RFC 6410 describes the four conditions
for advancing a specification to Internet Standard.

    (1) There are at least two independent interoperating implementations
        with widespread deployment and successful operational experience.

    (2) There are no errata against the specification that would cause a
        new implementation to fail to interoperate with deployed ones.

    (3) There are no unused features in the specification that greatly
        increase implementation complexity.

    (4) If the technology required to implement the specification
        requires patented or otherwise controlled technology, then the
        set of implementations must demonstrate at least two independent,
        separate and successful uses of the licensing process.

Point (1) needs to be documented and that includes deployment experience.

Regards,
Brian

>
>> -----Original Message-----
>> From: William Atwood [mailto:[e-mail]]
>> Sent: Tuesday, March 10, 2015 12:16 PM
>> To: [e-mail]; [e-mail]
>> Subject: Re: [pim] PIM and IPsec experience
>>
>> Stig,
>>
>> At Concordia, as part of the work supporting the development specified
>> in RFC 5796, we did a series of tests.
>>
>> 1) Two and three "soft" routers (Linux boxes running XORP) for the "same
>> key for everyone" and "separate keys for each sender" cases.
>>
>> 2) Two and three Cisco 2811 routers for the same two cases, except that
>> we could not run the "three-router, separate keys case for each sender"
>> case due to a limitation in the Cisco command line interface for manual
>> keying.
>>
>> 3) Inter-operation of a XORP router and a Cisco 2811, for both the
>> "same-key" and the "separate key" cases, with one XORP router and one
>> Cisco router.  (The "three-router, separate keys" case was not tried,
>> for the reasons given above.)
>>
>> 4) Inter-operation of a XORP router and a Cisco 2911.
>>
>> AH was used in all the tests.
>>
>> Since the establishment of the IPsec parameters is _completely_
>> independent of the PIM-SM code, I expect that it would not be difficult
>> to demonstrate inter-operation with ESP.  I would be willing to provide
>> the manpower to do this.
>>
>> The above establishes the existence of two independent inter-operating
>> implementations.  If I can find someone to loan me a suitable router
>> from another company (with IPsec enabled), I expect that it would not be
>> hard to demonstrate inter-operation with a third implementation, for
>> both AH and ESP.  (I would be willing to provide the manpower to do this.)
>>
>>   Bill
>>
>>
>> On 09/03/2015 8:10 PM, Stig Venaas wrote:
>>> Hi
>>>
>>> As part of making RFC 4601 an Internet Standard we would like to know to
>>> what extent there is experience with AH interoperability. Has anyone
>>> conducted tests or are aware of deployments with multiple
>>> implementations? What about ESP?
>>>
>>> It would also be interesting to know about deployments using IPsec,
>>> even if just a single implementation is involved. No need to name
>>> particular deployments, but it would be nice to get some idea how
>>> common it is.
>>>
>>> Stig
>>>
>>> _______________________________________________
>>> pim mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/pim
>>
>> --
>> Dr. J.W. Atwood, Eng.             tel:   [phone] x3046
>> Distinguished Professor Emeritus  fax:   [phone]
>> Department of Computer Science
>>    and Software Engineering
>> Concordia University EV 3.185     email:[e-mail]
>> 1455 de Maisonneuve Blvd. West    http://users.encs.concordia.ca/~bill
>> Montreal, Quebec Canada H3G 1M8
>
> _______________________________________________
> pim mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/pim
>