Re: [renum] Working Group Last Call: draft-ietf-6renum-gap-analysis-03.txt

Ran, Brian,

On Sep 19, 2012, at 12:39 PM, RJ Atkinson <rja.lists@gmail.com> wrote:
>>> Earlier, Marc Lampo wrote:
>>> One element is that in practice, not all devices "out there"
>>> (some very widely used) are not capable of defining the
>>> valid addresses on an IPSEC endpoint via DNS.
> 
> (With a confused look on my face)
> 
> I'm aware of numerous IPsec devices that do support
> the use of FQDNs, in addition to IP addresses, as
> IPsec SA endpoint identifiers.  Multiple products 
> (e.g. from Cisco, from Juniper [both JunOS and also
> ex-Netscreen products running ScreenOS], and 
> other products from many suppliers) support this
> -- and have done for many many years now.

I agree.  In fact, I remember configuring FQDN's, as IPsec SA endpoint ID's, in Netscreen devices (ScreenOS) as far back as the 2000-2001 timeframe.  I seem to recall Checkpoint FW-1 supporting a similar capability in that timeframe, as well.  Anyway, just more data points from my past experience to substantiate what Ran said above.

I'll echo what Ran said below:
> An example of a "very widely used" IPsec implementation
> that can't do this would be informative, to me at least, 
> if not on-list, then perhaps in a quick unicast email.

-shane

> In fact, I'm not aware of any IKEv1 or IKEv2 
> implementations that lack this, since it was 
> in the very very early specifications for ISAKMP/IKE.
> 
> However, in many cases, users don't seem to realise that 
> the capability exists, which is partly why the capability
> was noted in RFC-5887 and is repeated here.  
> 
> 
> Later, Brian Carpenter wrote:
>> True, that's an implementation and deployment gap,
>> not a protocol gap.  All we can do in the IETF is document
>> this kind of gap, since we don't control implementations.
> 
> Agreed.  To the extent that some IPsec implementation(s)
> d(oes)n't comply with long-standing (well over a decade old)
> IETF specs, that issue is outside the scope of an IETF WG.
> 
> However, the best information I have, and I've done some
> online checks today (without figuring out which item
> Marc is referring to), is that this capability is widely
> implemented and available -- albeit not so widely deployed.
> 
>> Nothing works if people don't use the global DNS correctly, ...
> 
> 
> Agreed.
> 
> 
> Yours,
> 
> Ran
> 
> _______________________________________________
> renum mailing list
> renum@ietf.org
> https://www.ietf.org/mailman/listinfo/renum
> 