Subject: [Hipsec] PATH (was HIP over STUN) meeting minutes

From: "Henderson, Thomas R" <[email-masked]>
Date: Wed, 17 Nov 2004 18:44:55 -0800

Attached are some unofficial minutes of the ad hoc HIP over STUN meeting
that was announced by Pekka on the list last week:
http://honor.trusecure.com/pipermail/hipsec/2004-November/001115.html

Preferred Alternatives for Tunneling HIP (PATH) meeting

Unofficial minutes (compiled by Tom Henderson) 

November 11, 2004

Announcement from Pekka:  This is an ad hoc meeting for people
interested in running HIP over NAT.  It was not approved by any
WG or AD as an official BOF, but the AD did give us a room.
IETF NOTE WELL (RFC 3667) applies.

Attendees:  
----------
Pekka Nikander
Lars Eggert
Tom Henderson
Andrei Gurtov
Jukka Ylitalo
Petri Jokela
Tero Kauppinen
Nick Papadoglou
Juergen Quittek
Martin Stiemerling
Robert Moskowitz
Andrew McGregor
Michael Richardson
Julien Laganier
Jeff Ahrenholz
Miika Komu
Mika Kousa
Hannes Tschofenig
Tim Shepard
Jari Arkko
James Kempf

Pekka presented slides (to be posted at HIP WG supplemental page) 

Goals:  
   - traverse legacy NATs
   - some firewalls but not all 
   - reachable behind NATs

Discussion on whether we want a modified variant of STUN that is
integrated
with HIP, or just allow HIP to use whatever is available.

Hannes Tschofenig:  Interested in i) UDP HIP format, and ii) way for
IPsec traffic to traverse.  We should consider other ways besides STUN,
for example, things being done for IKE.

Michael Richardson:  How much should we try to work on covering every
case?  Wondering if the set of networks that it doesn't work through
should be considered off-limits (because there might be a reason
that the administrator doesn't want it to work)

Martin Stiemerling:  Right, maybe NATs don't work for a purpose.

Tom Henderson:  I think we should just focus on the use cases that
other WGs are worrying about.  

Pekka:  I would like to solve 80% of the cases, not 100%.

Juergen Quittek:  We run into problems when we try to integrate
technology and merge things.  STUN took a long time to define and
get right.  Maybe run STUN without integrating HIP with it.

Julien Laganier: Noticed that VPN software often works over TCP,
over port 80, so maybe consider that.

Tom:  Would like to not force STUN or RVS/STUN integration on
people, but instead work on an approach that allows use of all possible 
mechanisms (TURN, ICE) etc.  Also SOCKS firewall traversal.

Juergen:  Yes, don't reinvent wheel, ADs will not like it
if our draft doesn't reuse previous work here.

Andrew McGregor:  We should split the effort into two drafts:
i) UDP packet formats and extensions to HIP parameters
ii) Procedures for using Rendezvous Server, etc.  

Tim Shepard:  I think we should standardize escalation techniques for 
finding NAT traversals, like how VPN software operates.

Michael:  Don't agree.  Nothing stops client from doing different
things.
Does not work if both behind NAT.  

Michael:  (situation 2 in Pekka's slides)-- only ever use if you 
have a symmetric NAT, but you should do this one because it is 
more portable.

Pekka:  (responding to a question on packet formats, I think it was
on the use of port numbers as a version number).  Want to save 8 bytes,
but also make it a bit ugly to discourage people from using this.

Tim (and others):  That will just discourage people from implementing
it, 
not using it.

Pekka:  Yes, but we have contradicting forces-- deployment, and keeping
the architecture clean.  

Jari Arkko:  We are forgetting about multihoming, mobility in this 
discussion.  Need to refresh state in network if I have all these
addresses.

Andrew:  (comment about locator format IPv4 format and pair of port
numbers
in the REA?)

Lars:  What about Teredo?

Tom:  OK except it doesn't support IPv4 only.

Pekka:  Most of implementors are in this room.  Do you want to implement
Teredo (no or few hands) or STUN (more hands).

Michael:  Although I am implementor, from a non-implementors point of
view, 
I was hoping that we did not focus on v4, because I see HIP as an avenue

to encourage v6 adoption.

Tom:  I don't want to deprecate v4 because we are also focused on
getting implementation experience on ID/locator split, from application
perspective.

Michael:  I don't understand why you want to write all this code if 
you have Teredo available.  Also, STUN will get deployed.  In favor of
reusing existing techniques.

Pekka:  Maybe we form two design teams.  
i) draft of packet formats over UDP, UDP-REA
ii) draft of how to run a rendezvous server

(meeting adjourned)
_______________________________________________
Hipsec mailing list
[email-masked]
http://honor.trusecure.com/mailman/listinfo/hipsec