Re: [renum] Working Group Last Call: draft-ietf-6renum-gap-analysis-03.txt

[RJ Atkinson <[e-mail]>]

>> Earlier, Marc Lampo wrote:
>> One element is that in practice, not all devices "out there"
>> (some very widely used) are not capable of defining the
>> valid addresses on an IPSEC endpoint via DNS.

(With a confused look on my face)

I'm aware of numerous IPsec devices that do support
the use of FQDNs, in addition to IP addresses, as
IPsec SA endpoint identifiers.  Multiple products 
(e.g. from Cisco, from Juniper [both JunOS and also
ex-Netscreen products running ScreenOS], and 
other products from many suppliers) support this
-- and have done for many many years now.

In fact, I'm not aware of any IKEv1 or IKEv2 
implementations that lack this, since it was 
in the very very early specifications for ISAKMP/IKE.

However, in many cases, users don't seem to realise that 
the capability exists, which is partly why the capability
was noted in RFC-5887 and is repeated here.  

An example of a "very widely used" IPsec implementation
that can't do this would be informative, to me at least, 
if not on-list, then perhaps in a quick unicast email.

Later, Brian Carpenter wrote:
> True, that's an implementation and deployment gap,
> not a protocol gap.  All we can do in the IETF is document
> this kind of gap, since we don't control implementations.

Agreed.  To the extent that some IPsec implementation(s)
d(oes)n't comply with long-standing (well over a decade old)
IETF specs, that issue is outside the scope of an IETF WG.

However, the best information I have, and I've done some
online checks today (without figuring out which item
Marc is referring to), is that this capability is widely
implemented and available -- albeit not so widely deployed.

> Nothing works if people don't use the global DNS correctly, ...


Agreed.


Yours,

Ran