Re: [pim] PIM and IPsec experience

On Tue, Mar 10, 2015 at 2:59 PM, Toerless Eckert <eckert@cisco.com> wrote:

> If we assume very little deployment epxerience... where would that
> leave us wrt. to AH vs. ESP vs how to move forward on the spec side ?
>

We are checking to see how the RFC Editor can handle Updates for 4601bis.
It would be useful in 4601bis to have Informational references to the
various RFCs
that update 4601 and help set them in context for a future reader.

Alia

> Cheers
>     Toerless
>
> On Tue, Mar 10, 2015 at 04:23:11PM +0000, Jeffrey (Zhaohui) Zhang wrote:
> > Lab testing can provide data on interoperability, but what about
> deployment experiences?
> >
> > > -----Original Message-----
> > > From: William Atwood [mailto:william.atwood@concordia.ca]
> > > Sent: Tuesday, March 10, 2015 12:16 PM
> > > To: pim@ietf.org; draft-ietf-pim-rfc4601bis@ietf.org
> > > Subject: Re: [pim] PIM and IPsec experience
> > >
> > > Stig,
> > >
> > > At Concordia, as part of the work supporting the development specified
> > > in RFC 5796, we did a series of tests.
> > >
> > > 1) Two and three "soft" routers (Linux boxes running XORP) for the
> "same
> > > key for everyone" and "separate keys for each sender" cases.
> > >
> > > 2) Two and three Cisco 2811 routers for the same two cases, except that
> > > we could not run the "three-router, separate keys case for each sender"
> > > case due to a limitation in the Cisco command line interface for manual
> > > keying.
> > >
> > > 3) Inter-operation of a XORP router and a Cisco 2811, for both the
> > > "same-key" and the "separate key" cases, with one XORP router and one
> > > Cisco router.  (The "three-router, separate keys" case was not tried,
> > > for the reasons given above.)
> > >
> > > 4) Inter-operation of a XORP router and a Cisco 2911.
> > >
> > > AH was used in all the tests.
> > >
> > > Since the establishment of the IPsec parameters is _completely_
> > > independent of the PIM-SM code, I expect that it would not be difficult
> > > to demonstrate inter-operation with ESP.  I would be willing to provide
> > > the manpower to do this.
> > >
> > > The above establishes the existence of two independent inter-operating
> > > implementations.  If I can find someone to loan me a suitable router
> > > from another company (with IPsec enabled), I expect that it would not
> be
> > > hard to demonstrate inter-operation with a third implementation, for
> > > both AH and ESP.  (I would be willing to provide the manpower to do
> this.)
> > >
> > >   Bill
> > >
> > >
> > > On 09/03/2015 8:10 PM, Stig Venaas wrote:
> > > > Hi
> > > >
> > > > As part of making RFC 4601 an Internet Standard we would like to
> know to
> > > > what extent there is experience with AH interoperability. Has anyone
> > > > conducted tests or are aware of deployments with multiple
> > > > implementations? What about ESP?
> > > >
> > > > It would also be interesting to know about deployments using IPsec,
> > > > even if just a single implementation is involved. No need to name
> > > > particular deployments, but it would be nice to get some idea how
> > > > common it is.
> > > >
> > > > Stig
> > > >
> > > > _______________________________________________
> > > > pim mailing list
> > > > pim@ietf.org
> > > > https://www.ietf.org/mailman/listinfo/pim
> > >
> > > --
> > > Dr. J.W. Atwood, Eng.             tel:   +1 (514) 848-2424 x3046
> > > Distinguished Professor Emeritus  fax:   +1 (514) 848-2830
> > > Department of Computer Science
> > >    and Software Engineering
> > > Concordia University EV 3.185     email:william.atwood@concordia.ca
> > > 1455 de Maisonneuve Blvd. West    http://users.encs.concordia.ca/~bill
> > > Montreal, Quebec Canada H3G 1M8
> >
> > _______________________________________________
> > pim mailing list
> > pim@ietf.org
> > https://www.ietf.org/mailman/listinfo/pim
>
> --
> ---
> Toerless Eckert, eckert@cisco.com
>
> _______________________________________________
> pim mailing list
> pim@ietf.org
> https://www.ietf.org/mailman/listinfo/pim
>