Re: [pim] PIM and IPsec experience

Lab testing can provide data on interoperability, but what about deployment experiences?

> -----Original Message-----
> From: William Atwood [mailto:william.atwood@concordia.ca]
> Sent: Tuesday, March 10, 2015 12:16 PM
> To: pim@ietf.org; draft-ietf-pim-rfc4601bis@ietf.org
> Subject: Re: [pim] PIM and IPsec experience
> 
> Stig,
> 
> At Concordia, as part of the work supporting the development specified
> in RFC 5796, we did a series of tests.
> 
> 1) Two and three "soft" routers (Linux boxes running XORP) for the "same
> key for everyone" and "separate keys for each sender" cases.
> 
> 2) Two and three Cisco 2811 routers for the same two cases, except that
> we could not run the "three-router, separate keys case for each sender"
> case due to a limitation in the Cisco command line interface for manual
> keying.
> 
> 3) Inter-operation of a XORP router and a Cisco 2811, for both the
> "same-key" and the "separate key" cases, with one XORP router and one
> Cisco router.  (The "three-router, separate keys" case was not tried,
> for the reasons given above.)
> 
> 4) Inter-operation of a XORP router and a Cisco 2911.
> 
> AH was used in all the tests.
> 
> Since the establishment of the IPsec parameters is _completely_
> independent of the PIM-SM code, I expect that it would not be difficult
> to demonstrate inter-operation with ESP.  I would be willing to provide
> the manpower to do this.
> 
> The above establishes the existence of two independent inter-operating
> implementations.  If I can find someone to loan me a suitable router
> from another company (with IPsec enabled), I expect that it would not be
> hard to demonstrate inter-operation with a third implementation, for
> both AH and ESP.  (I would be willing to provide the manpower to do this.)
> 
>   Bill
> 
> 
> On 09/03/2015 8:10 PM, Stig Venaas wrote:
> > Hi
> >
> > As part of making RFC 4601 an Internet Standard we would like to know to
> > what extent there is experience with AH interoperability. Has anyone
> > conducted tests or are aware of deployments with multiple
> > implementations? What about ESP?
> >
> > It would also be interesting to know about deployments using IPsec,
> > even if just a single implementation is involved. No need to name
> > particular deployments, but it would be nice to get some idea how
> > common it is.
> >
> > Stig
> >
> > _______________________________________________
> > pim mailing list
> > pim@ietf.org
> > https://www.ietf.org/mailman/listinfo/pim
> 
> --
> Dr. J.W. Atwood, Eng.             tel:   +1 (514) 848-2424 x3046
> Distinguished Professor Emeritus  fax:   +1 (514) 848-2830
> Department of Computer Science
>    and Software Engineering
> Concordia University EV 3.185     email:william.atwood@concordia.ca
> 1455 de Maisonneuve Blvd. West    http://users.encs.concordia.ca/~bill
> Montreal, Quebec Canada H3G 1M8