Subject: Re: ForCES transport requirements WAS (Re: Support for multicast in the ForCES protocol

From: Tal Anker <[email-masked]>
Date: Tue, 25 Nov 2003 09:01:17 +0200

I have to say that I also have the security requirements at a very low priority for forces... I also expect the CE-FE communication to be deployed on _internal_ links, where security is not really an issue (while preventing from external traffic from the open network from being considered as CE-FE control traffic is quite easy to be done using other mechanisms...).
Since the security mechanisms can be later incorporated, should they be considered as critical at these phase to prevent from having multicast for the CE-FE communication?

- Tal

-----Original Message-----
From: Steven Blake [mailto:[email-masked]]
Sent: Tuesday, November 25, 2003 4:20 AM
To: [email-masked]
Subject: Re: ForCES transport requirements WAS (Re: Support for multicast in the ForCES protocol

On Mon, 2003-11-24 at 15:35, Khosravi, Hormuzd M wrote:

> Hi Tal
>
> There is already a ForCES Requirements draft which has been approved for
> RFC.
> Pls see...
> http://www.ietf.org/internet-drafts/draft-ietf-forces-requirements-10.tx
> t
> This has a section on protocol requirements.

The problem with this draft (IMHO) is that it specifies a very broad
range of requirements, and it is not clear that they can all be
satisfied simultaneously using the same protocol techniques (which is
not to say that they cannot be satisfied using the same protocol, it
will however have to be very flexible).

Another problem is that there is no prioritization applied to the
requirements.  Therefore, different individuals prioritize them
independently based on their own priorities and product requirements.

I personally prioritize scalability and timeliness, and really have no
use for the security requirement, because I don't envision having to
deploy CE-FE communications over an open network.  Other opinions may
differ.

Regards,

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Steven L. Blake               <[email-masked]>
Ericsson IP Infrastructure                +1 919-472-9913

---

From: Alex Audu <[email-masked]>
Date: Tue, 25 Nov 2003 10:42:13 -0600

Once you distribute CEs and FEs such that they are no longer co-located,
you have to worry about security. The RPSEC group is currently specifying
the requirements for secure routing protocols. If you expose the interconnect
between CEs and FEs as ForCES does, then you have to address how your
ForCES protocol solution is not going to make the routing protocol security
worse. Else, such a solution won't fly in IETF.

Regards,
Alex.