Re: [pim] PIM and IPsec experience

[Brian Haberman <[e-mail]>]

Hi Toerless,

On 3/11/15 9:37 AM, Toerless Eckert wrote:
> Sure, such a list sounds iuseful. But that does not answer my question.
> 

Let me take a crack at it.

> 
> On Tue, Mar 10, 2015 at 03:04:13PM -0400, Alia Atlas wrote:
>> On Tue, Mar 10, 2015 at 2:59 PM, Toerless Eckert <[e-mail]> wrote:
>>
>>> If we assume very little deployment epxerience... where would that
>>> leave us wrt. to AH vs. ESP vs how to move forward on the spec side ?
>>>

The rules on advancing a specification to IS are rather clear on this.
If a feature does not have wide implementation and deployment
experience, it is pulled out of the specification.

In the case of 4601bis, I would suspect that section 6.3 would be taken
out.  If so, it could be replaced with an informative reference to RFC 5796.

The other RFCs that update 4601 would need to be examined to see how
they impact the spec as well.

Regards,
Brian

>>
>> We are checking to see how the RFC Editor can handle Updates for 4601bis.
>> It would be useful in 4601bis to have Informational references to the
>> various RFCs
>> that update 4601 and help set them in context for a future reader.
>>
>> Alia
>>
>>
>>
>>> Cheers
>>>     Toerless
>>>
>>> On Tue, Mar 10, 2015 at 04:23:11PM +0000, Jeffrey (Zhaohui) Zhang wrote:
>>>> Lab testing can provide data on interoperability, but what about
>>> deployment experiences?
>>>>
>>>>> -----Original Message-----
>>>>> From: William Atwood [mailto:[e-mail]]
>>>>> Sent: Tuesday, March 10, 2015 12:16 PM
>>>>> To: [e-mail]; [e-mail]
>>>>> Subject: Re: [pim] PIM and IPsec experience
>>>>>
>>>>> Stig,
>>>>>
>>>>> At Concordia, as part of the work supporting the development specified
>>>>> in RFC 5796, we did a series of tests.
>>>>>
>>>>> 1) Two and three "soft" routers (Linux boxes running XORP) for the
>>> "same
>>>>> key for everyone" and "separate keys for each sender" cases.
>>>>>
>>>>> 2) Two and three Cisco 2811 routers for the same two cases, except that
>>>>> we could not run the "three-router, separate keys case for each sender"
>>>>> case due to a limitation in the Cisco command line interface for manual
>>>>> keying.
>>>>>
>>>>> 3) Inter-operation of a XORP router and a Cisco 2811, for both the
>>>>> "same-key" and the "separate key" cases, with one XORP router and one
>>>>> Cisco router.  (The "three-router, separate keys" case was not tried,
>>>>> for the reasons given above.)
>>>>>
>>>>> 4) Inter-operation of a XORP router and a Cisco 2911.
>>>>>
>>>>> AH was used in all the tests.
>>>>>
>>>>> Since the establishment of the IPsec parameters is _completely_
>>>>> independent of the PIM-SM code, I expect that it would not be difficult
>>>>> to demonstrate inter-operation with ESP.  I would be willing to provide
>>>>> the manpower to do this.
>>>>>
>>>>> The above establishes the existence of two independent inter-operating
>>>>> implementations.  If I can find someone to loan me a suitable router
>>>>> from another company (with IPsec enabled), I expect that it would not
>>> be
>>>>> hard to demonstrate inter-operation with a third implementation, for
>>>>> both AH and ESP.  (I would be willing to provide the manpower to do
>>> this.)
>>>>>
>>>>>   Bill
>>>>>
>>>>>
>>>>> On 09/03/2015 8:10 PM, Stig Venaas wrote:
>>>>>> Hi
>>>>>>
>>>>>> As part of making RFC 4601 an Internet Standard we would like to
>>> know to
>>>>>> what extent there is experience with AH interoperability. Has anyone
>>>>>> conducted tests or are aware of deployments with multiple
>>>>>> implementations? What about ESP?
>>>>>>
>>>>>> It would also be interesting to know about deployments using IPsec,
>>>>>> even if just a single implementation is involved. No need to name
>>>>>> particular deployments, but it would be nice to get some idea how
>>>>>> common it is.
>>>>>>
>>>>>> Stig
>>>>>>
>>>>>> _______________________________________________
>>>>>> pim mailing list
>>>>>> [e-mail]
>>>>>> https://www.ietf.org/mailman/listinfo/pim
>>>>>
>>>>> --
>>>>> Dr. J.W. Atwood, Eng.             tel:   [phone] x3046
>>>>> Distinguished Professor Emeritus  fax:   [phone]
>>>>> Department of Computer Science
>>>>>    and Software Engineering
>>>>> Concordia University EV 3.185     email:[e-mail]
>>>>> 1455 de Maisonneuve Blvd. West    http://users.encs.concordia.ca/~bill
>>>>> Montreal, Quebec Canada H3G 1M8
>>>>
>>>> _______________________________________________
>>>> pim mailing list
>>>> [e-mail]
>>>> https://www.ietf.org/mailman/listinfo/pim
> 
> _______________________________________________
> pim mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/pim
>