Subject: RE: [Sipping] VPN session established by SIP

From: "Shimon Nurick" <[email-masked]>
Date: Tue, 17 Jan 2006 08:59:49 +0200

VPN by its nature a client server mechanism, not a point to point -
And SIP to date, has got a long way to go, to be the choice for crossing
all the NW horrors.

According to the logic running here all protocols can be replaced by SIP
-
Why do HTTP if you can do SIP - Do SIP and application/HTTP ?
Why do Telnet if you can do SIP - Do SIP and application/Telnet?
etc...... 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Dale R. Worley
Sent: Monday, 16 January, 2006 16:46
To: Sipping
Subject: Re: [Sipping] VPN session established by SIP

On Fri, 2006-01-13 at 21:56 -0600, Dean Willis wrote:
> Of course they will. But nothing says that the endpoints, now that 
> they've "found" each other using SIP, can't start an IKE exchange to 
> set up keying for IPSEC. IKEv2 is about key management, not 
> correspondent discovery. Or they can do a TLS VPN. Or even (watch more

> ADs explode) a VPN over MSRP relays.

SIP seems to have two advantages here.  One is that the business drivers
will lead to it being widely deployed, with good interoperability, and
workable ways of dealing with NATs, firewalls, and other network
horrors, so piggybacking on SIP has a high probability of working out of
the box in any given situation.

The more technically pleasing advantage is that SIP does not apply any
packet-by-packet wrapper to the "session" data itself, so there's no
penalty relative to the "native" tunneling protocol.

I'm starting to visualize SIP bodies with content-type "application/ike-
setup"...

Dale

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP Use
[email-masked] for questions on current sip Use
[email-masked] for new developments of core SIP

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: Dean Willis <[email-masked]>
Date: Tue, 17 Jan 2006 15:31:23 -0600

> VPN by its nature a client server mechanism, not a point to point -

Ok, I'll bite. How is A GRE tunnel running between two Linux boxes or  
two Cisco routers a client-server mechanism and not point-to-point or  
peer-to-peer?

By the same logic, how is an IPSEC SA between two boxes a client- 
server mechanism?

> And SIP to date, has got a long way to go, to be the choice for  

well, it seems to work. We do seem to have a very strong mechanism  
for at least locating and engaging in signaling with a correspondent  
on the other side of "network horrors". That's enough to do a lot of  
interesting things. Not enough to solve all the horrors of NAT and  
firewalls, obviously.

> Why do Telnet if you can do SIP - Do SIP and application/Telnet?

That's definitely a valid concern.

I think the application here is a little narrower -- the suggestion  
is that correspondent discovery and session negotiation and  
management can be handled by SIP. The argument is about what  
constitutes a "session" in this context.

Is a Half Life 2 game connection a "session"?  I'd tend to think so,  
even though it encompasses a broad range of file transfer, event  
synchronization, and multipoint audio conferencing capabilities.

Is an MSRP session a valid session for being established by SIP? One  
would presume so, as that's what it is being developed for.

What if the MSRP session is used for file transfer instead of  
messaging?  That seems to be allowed for in the spec.

What if the messages being passed are IP packets that are then handed  
back into the networking layer of the endpoint as if they came from a  
virtual interface?

I argue that it might be overkill, that it might have other  
undesirable characteristics, but that it's still a legitimate use of  
the signaling protocol, and probably even a legitimate use of the  
transport protocol.

--
Dean

---

From: Arjun Roychowdhury <[email-masked]>
Date: Tue, 17 Jan 2006 17:01:56 -0500

Good Stuff. This looks like a right time to revive SIP for device control.
After all, if VPN makes sense and could extend the meaning of a session,
surely so could using SIP to control devices ?

(doctor's note: brickbats must be duly padded before they are thrown at me)

regds
arjun

On 1/17/06, Dean Willis <[email-masked]> wrote:
> Arjun Roychowdhury

---

From: Dean Willis <[email-masked]>
Date: Wed, 18 Jan 2006 12:59:46 -0600

On Jan 17, 2006, at 4:01 PM, Arjun Roychowdhury wrote:

> Good Stuff. This looks like a right time to revive SIP for device  
> control. After all, if VPN makes sense and could extend the meaning  
> of a session, surely so could using SIP to control devices ?
>

The fact that I agree with you doesn't put either the VPN thing or  
device control in scope for the working group.

So, I must re-iterate. This stuff is ok to talk about briefly, but  
unless our charter changes, we won't be investing working group  
efforts in it.

--
Dean

---

From: Richard Shockey <[email-masked]>
Date: Thu, 19 Jan 2006 20:45:36 -0500

Dean Willis wrote:
>> control. After all, if VPN makes sense and could extend the meaning of 
>> a session, surely so could using SIP to control devices ?
>>
> unless our charter changes, we won't be investing working group efforts 
> in it.
> 

So those who are interested in this can form another WG!

I think it would be useful in Dallas to carve out a reasonable amount of 
time to hear what the level of support for such an initiative might heve.

-- 

Richard Shockey, Director - Member of Technical Staff
NeuStar Inc.
46000 Center Oak Plaza  -   Sterling, VA  20166
sip:rshockey(at)iptel.org   sip:57141(at)fwd.pulver.com
ENUM +87810-13313-31331
PSTN Office +1 571.434.5651 PSTN Mobile +1 703.593.2683
Fax: +1 815.333.1237
<mailto:richard(at)shockey.us> or
<mailto:richard.shockey(at)neustar.biz>
<http://www.neustar.biz> ; <http://www.enum.org>
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

---

From: "Henry Sinnreich" <[email-masked]>
Date: Fri, 20 Jan 2006 08:52:41 -0600

I agree with Dean. If y'all really want SIP to succeed, the best option is
to freeze any more new I-Ds and let's just get to market with what is
already been documented

If there is anyone in doubt, please take a look at http://rfc3261.net/ 

Well,... P2P SIP may be one of the exceptions that should confirm this call
to constraint, since P2P traffic is dominant on the Internet and P2P VoIP
(Skype) is also dominant.

Thanks, Henry

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of Richard Shockey
Sent: Thursday, January 19, 2006 7:46 PM
To: Dean Willis
Cc: Sipping
Subject: Re: [Sipping] VPN session established by SIP

--