Subject: [I2nsf] IPSec attributes that can be controlled by SDN controller ( was RE: Slides for Wednesday's meeting

From: Linda Dunbar <[email-masked]>
Date: Wed, 6 Sep 2017 14:30:10 +0000

Tero,

At IETF 99 Friday breakfast, we discussed the draft-abad-i2nsf-sdn-ipsec-flow-protection-03, you stated:
      - It is OK for external controller to manage SPD, PAD distribution, and manage IKE distribution, but
      - It is a problem for external controller to manage SAD (Security Association Distribution) because both end points of one IPsec tunnel need to maintain the same SAD. During reboot, controller might lose track of the SAD on either end points.

My question: who can manage the SAD (Security Association Distribution) if two devices are not collocated?

Linda

-----Original Message-----
From: Tero Kivinen [mailto:[email-masked]]
Sent: Tuesday, September 05, 2017 7:38 AM
To: Yoav Nir <[email-masked]>
Cc: Paul Wouters <[email-masked]>; Gabriel Lopez <[email-masked]>; Rafa Marin-Lopez <[email-masked]>; Linda Dunbar <[email-masked]>
Subject: Slides for Wednesday's meeting

Yoav Nir writes:
> If you'd like to present some slides at Wednesday's meeting, please
> send them to us.  PDF, PPT, PPTX, KEY, or ODP are all acceptable, but
> all will be converted to PDF.  We will present using Webex, but some
> participants may have low bandwidth and prefer to download the slides.
>
> They will be posted to the meeting material page:
> https://datatracker.ietf.org/meeting/interim-2017-i2nsf-01/session/i2n
> sf

I quickly wrote something, but as I have been quite busy after I got back from eclipse [1] trip, I did not have too much time to prepare for the presentation, so I hope this what I managed to create is enough. On the other hand I think there was only 5 minutes for me, so ...