Subject: AW: [Sipping] VPN session established by SIP

From: "Tschofenig, Hannes" <[email-masked]>
Date: Fri, 13 Jan 2006 14:33:17 +0100

i am not sure whether it is actually a good idea to use sip to establish ipsec tunnels (although possible). 
the problem is that you have a little bit of overlap with ikev2 (if you are talking about ipsec-based vpns). addtionally, it only makes sense if you create ipsec sas between the end points (most likely). btw, ikev2 also provides mechanisms for nat traversal. 

how would you setup ipsec sa establishment with sip? 
put the ipsec parameter exchange into mikey (instead of creating srtp security associations, for example)
derive keying material provided during the mikey exchange for ipsec sas.  

ciao
hannes

> -----Ursprüngliche Nachricht-----
> Von: [email-masked] 
> [mailto:[email-masked]] Im Auftrag von Jonathan Rosenberg
> Gesendet: Freitag, 13. Januar 2006 14:20
> An: YOSHIKAWA Tomoyuki
> Cc: [email-masked]
> Betreff: Re: [Sipping] VPN session established by SIP
> 
> There is no specification for this. SIP has been designed for 
> establishment of communications sessions, not really for VPN 
> establishment.
> 
> -Jonathan R.
> 
> YOSHIKAWA Tomoyuki wrote:
> 
> > Hello All,
> > 
> > I'd like to establish VPN session by using SIP control.
> > I think it is very convenient the establishment of Virtual Private
> > Network (VPN) through some NAT equipments under-controlling 
> by Session
> > Beorder Controller of SIP.
> > In the establishment of VPN by SIP,
> > there might be the SIP level security mechanism and VPN own level
> > security mechanism. 
> > 
> > Are there some mechanism of establishing VPN sessions
> > such as L2TP or PPTP by SIP already?
> > I'd like to make a document if there isn't 
> > document about such kind of mechanism.
> > 
> > Or Making VPN by SIP mechanism might be enhancing
> > concerning SDP description as like as RFC2848(PINT Service)?
> >  exam:  m=application 42124 udp l2tp
> >         a=fmtp:l2tp protocol=ppp,role=client
> > 
> > Please let me know your comment.
> > 
> > Does this topic match to the mmusic mailing list more?
> > I apologize if this subject is off-topic for this mailing list.
> > 
> > Best regards,
> > ------
> > YOSHIKAWA Tomoyuki <[email-masked]>
> > NEXT GENERATION NETWORK STRATEGY
> > RESEARCH AND DEVELOPMENT CENTER
> > NETWORK BUSINESS HEADQUARTERS
> > NTT EAST
> > 
> > _______________________________________________
> > Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
> > This list is for NEW development of the application of SIP
> > Use [email-masked] for questions on current sip
> > Use [email-masked] for new developments of core SIP
> > 
> 
> -- 
> Jonathan D. Rosenberg, Ph.D.                   600 Lanidex Plaza
> Cisco Fellow                                   Parsippany, NJ 
> 07054-2711
> Cisco Systems
> [email-masked]                              FAX:   (973) 952-5050
> http://www.jdrosen.net                         PHONE: (973) 952-5000
> http://www.cisco.com
> 
> _______________________________________________
> Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
> This list is for NEW development of the application of SIP
> Use [email-masked] for questions on current sip
> Use [email-masked] for new developments of core SIP
> 

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: "Roy, Radhika R." <[email-masked]>
Date: Wed, 18 Jan 2006 10:21:44 -0500

Yes, it is the right observation.

As indicated before: It is one of the laws known as "Oran's Law # 3."

Cheers!
Radhika

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of David R Oran
Sent: Wednesday, January 18, 2006 9:51 AM
To: Brijesh Kumar
Cc: Sipping
Subject: Re: [Sipping] VPN session established by SIP

Oran's law of application protocols states:

"Any application protocol which demonstrates any degree of success  
inevitably winds up being used as a transport protocol for some other  
application, or even as a tunnel for a lower layer protocol".