Re: [TLS] Draft minutes for IETF-75 available

[Gerhard Muenz <[e-mail]>]

Joseph,

Joseph Salowey (jsalowey) wrote:
> Thanks Gerhard,
> 
> Minutes updated.   
> 
> Some questions below:
> 
> <snip> 
>> Some thoughts about the proposal to solve Heartbeat at the 
>> IPFIX layer (from me as a contributor to IPFIX):
>> It is extremely unlikely that we will change the IPFIX 
>> protocol from unidirectional to bidirectional just because 
>> DTLS-over-UDP requires it.
>> In my opinion, if we had to choose, it would be more likely 
>> that we would update RFC5101 saying that DTLS is not required 
>> any more for IPFIX-over-UDP implementations, and that the 
>> usage of IPFIX-over-DTLS/UDP is not recommended because of 
>> the dead peer detection problem.
> 
> [Joe] Is IPFIX defined over UDP without DTLS?  If so, would
> IPFIX-over-UDP have a dead peer detection problem of its own?  

Thanks for you interest in this problem.

The answer is yes and no.

Yes, it is a problem because with UDP the Exporter will never know
exactly if the Collector is up and receiving IPFIX Messages. A
non-existing Collector can be detected via returned ICMP messages
(destination unreachable and the like). However, such messages are often
blocked by firewalls.

However, no, it is not such a big problem because UDP is unrealiable anyway.

The big difference between IPFIX-over-UDP and IPFIX-over-DTLS/UDP is
that you can always start or restart a UDP Collector without touching
the Exporter. If the Collector is listening on the correct UDP port, it
will receive the Templates after a while (Templates are retransmitted
periodically when UDP is used), and then, it will be able to start or
resume decoding IPFIX Messages.

With DTLS/UDP, the Exporter must initiate the DTLS renegotiation after
the Collector has restarted. This is because the Collector does not know
which Exporters actually exist (like a server which does not know its
clients in advance). So, the Exporter should somehow know when a
renegotiation is necessary. It seems that DTLS Heartbeat would nicely
solve this.

Regards,
Gerhard


>> IPFIX cannot reasonably deploy DTLS for UDP without the 
>> proposed Heartbeat extension. The available workarounds are 
>> not very nice.
>>
> 
> 
>> Regards,
>> Gerhard
>>