Re: [pim] PIM and IPsec experience

If we assume very little deployment epxerience... where would that
leave us wrt. to AH vs. ESP vs how to move forward on the spec side ?

Cheers
    Toerless

On Tue, Mar 10, 2015 at 04:23:11PM +0000, Jeffrey (Zhaohui) Zhang wrote:
> Lab testing can provide data on interoperability, but what about deployment experiences?
> 
> > -----Original Message-----
> > From: William Atwood [mailto:william.atwood@concordia.ca]
> > Sent: Tuesday, March 10, 2015 12:16 PM
> > To: pim@ietf.org; draft-ietf-pim-rfc4601bis@ietf.org
> > Subject: Re: [pim] PIM and IPsec experience
> > 
> > Stig,
> > 
> > At Concordia, as part of the work supporting the development specified
> > in RFC 5796, we did a series of tests.
> > 
> > 1) Two and three "soft" routers (Linux boxes running XORP) for the "same
> > key for everyone" and "separate keys for each sender" cases.
> > 
> > 2) Two and three Cisco 2811 routers for the same two cases, except that
> > we could not run the "three-router, separate keys case for each sender"
> > case due to a limitation in the Cisco command line interface for manual
> > keying.
> > 
> > 3) Inter-operation of a XORP router and a Cisco 2811, for both the
> > "same-key" and the "separate key" cases, with one XORP router and one
> > Cisco router.  (The "three-router, separate keys" case was not tried,
> > for the reasons given above.)
> > 
> > 4) Inter-operation of a XORP router and a Cisco 2911.
> > 
> > AH was used in all the tests.
> > 
> > Since the establishment of the IPsec parameters is _completely_
> > independent of the PIM-SM code, I expect that it would not be difficult
> > to demonstrate inter-operation with ESP.  I would be willing to provide
> > the manpower to do this.
> > 
> > The above establishes the existence of two independent inter-operating
> > implementations.  If I can find someone to loan me a suitable router
> > from another company (with IPsec enabled), I expect that it would not be
> > hard to demonstrate inter-operation with a third implementation, for
> > both AH and ESP.  (I would be willing to provide the manpower to do this.)
> > 
> >   Bill
> > 
> > 
> > On 09/03/2015 8:10 PM, Stig Venaas wrote:
> > > Hi
> > >
> > > As part of making RFC 4601 an Internet Standard we would like to know to
> > > what extent there is experience with AH interoperability. Has anyone
> > > conducted tests or are aware of deployments with multiple
> > > implementations? What about ESP?
> > >
> > > It would also be interesting to know about deployments using IPsec,
> > > even if just a single implementation is involved. No need to name
> > > particular deployments, but it would be nice to get some idea how
> > > common it is.
> > >
> > > Stig
> > >
> > > _______________________________________________
> > > pim mailing list
> > > pim@ietf.org
> > > https://www.ietf.org/mailman/listinfo/pim
> > 
> > --
> > Dr. J.W. Atwood, Eng.             tel:   +1 (514) 848-2424 x3046
> > Distinguished Professor Emeritus  fax:   +1 (514) 848-2830
> > Department of Computer Science
> >    and Software Engineering
> > Concordia University EV 3.185     email:william.atwood@concordia.ca
> > 1455 de Maisonneuve Blvd. West    http://users.encs.concordia.ca/~bill
> > Montreal, Quebec Canada H3G 1M8
> 
> _______________________________________________
> pim mailing list
> pim@ietf.org
> https://www.ietf.org/mailman/listinfo/pim

-- 
---
Toerless Eckert, eckert@cisco.com