Subject: [IPFIX] ipfix over TLS/DTLS

From: Ma Yuzhi <[email-masked]>
Date: Tue, 12 Sep 2006 08:50:24 +0800

Hi all,

I submitted the ipfix over TLS/DTLS draft last two weeks. This document
describes the use of Transport Layer Security (TLS) and Datagram Transport
Layer Security (DTLS) to provide a secure communication for the transport of
IPFIX protocol. A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-yuzhi-ipfix-transport-tls-00.txt

Your comments are welcome.

Thanks,
Yuzhi

_______________________________________________
IPFIX mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipfix

---

From: "Bora Akyol" <[email-masked]>
Date: Mon, 11 Sep 2006 19:52:11 -0700

I think I would like to see a detailed section why IPSEC is not
considered as a suitable alternative for this application.

Regards

Bora

> -----Original Message-----
> From: Ma Yuzhi [mailto:[email-masked]] 
> Sent: Monday, September 11, 2006 5:50 PM
> To: [email-masked]
> Subject: [IPFIX] ipfix over TLS/DTLS
> 
> Hi all,
> 
> I submitted the ipfix over TLS/DTLS draft last two weeks. 
> This document describes the use of Transport Layer Security 
> (TLS) and Datagram Transport Layer Security (DTLS) to provide 
> a secure communication for the transport of IPFIX protocol. A 
> URL for this Internet-Draft is:

---

From: "Bora Akyol" <[email-masked]>
Date: Mon, 11 Sep 2006 19:52:11 -0700

Regards

Bora

---

From: Jeroen Massar <[email-masked]>
Date: Tue, 12 Sep 2006 07:54:58 +0200

> considered as a suitable alternative for this application.

Ever configured IPSEC? :) That is the main issue. Configuring IPSEC is 
quite difficult on most platforms. Also IPSEC is not always available or 
at least hard to get on others. TLS though is available on most if not 
all platforms, simply because they use OpenSSL or a similar library to 
do the core of the job. Give it a cert, give it a name. Done.

This doesn't mean I am saying that one should exclude IPSEC is a method 
of securing IPFIX though, as using IPFIX+IPSEC is a very good setup.

Greets,
  Jeroen

---

From: Jeroen Massar <[email-masked]>
Date: Tue, 12 Sep 2006 07:54:58 +0200

Greets,
  Jeroen

---

From: "Bora Akyol" <[email-masked]>
Date: Tue, 12 Sep 2006 08:44:39 -0700

Yes I have.

I also wrote quite a bit of IPSEC and IKE code that runs on a large
percentage of routers and switches out there today.

I think it is a VERY poor excuse to say that we can not configure IPSEC
and therefore it can not be used.

Let me know if you have any specific questions on IPSEC/IKE
configuration and I will see what I can do to help you.

Bora

> From: Jeroen Massar [mailto:[email-masked]] 
> Sent: Monday, September 11, 2006 10:55 PM
> To: Bora Akyol
> Cc: Ma Yuzhi; [email-masked]
> Subject: Re: [IPFIX] ipfix over TLS/DTLS
> 
> Bora Akyol wrote:
> Ever configured IPSEC? :) That is the main issue. Configuring 
> IPSEC is quite difficult on most platforms. Also IPSEC is not 
> always available or at least hard to get on others. TLS 
> though is available on most if not all platforms, simply 
> because they use OpenSSL or a similar library to do the core 
> of the job. Give it a cert, give it a name. Done.
> 
> This doesn't mean I am saying that one should exclude IPSEC 
> is a method of securing IPFIX though, as using IPFIX+IPSEC is 
> a very good setup.
> 
> Greets,
>   Jeroen
> 
>

---

From: "Bora Akyol" <[email-masked]>
Date: Tue, 12 Sep 2006 08:44:39 -0700

Yes I have.

Bora

---

From: Jeroen Massar <[email-masked]>
Date: Tue, 12 Sep 2006 18:09:11 +0200

> and therefore it can not be used.

Just to clarify, I didn't say "we can't configure IPSEC", just that it 
is a difficult process to configure it. Most IPSEC setups that I came 
across where done host<->host, and in that field IPSEC is really not so 
easy to configure.

Afaik most of the current IPFIX implementations (at least the ones 
showing up at the interop), collector and meter side, run on Linux/BSD 
based hosts, not on the routers in between. As such the host needs to be 
configured. Notez bien that the moment one configures IPSEC between two 
routers to protect a link one is effectively making a tunnel. IPFIX over 
UDP/TCP/SCTP/etc doesn't care through which tunnel it goes.

>> is a method of securing IPFIX though, as using IPFIX+IPSEC is 

To rephrase bulletwise:
   - IPFIX over TLS/DTLS should be possible and available in RFC/STD
   - IPFIX over IPSEC should be possible and available in RFC/STD

I don't think you would have a problem with that no?

Greets,
  Jeroen

(PS: IPSEC on a _switch_ ? Switches are L2 thus don't do IP do they? :)

---

From: Jeroen Massar <[email-masked]>
Date: Tue, 12 Sep 2006 18:09:11 +0200

To rephrase bulletwise:

Greets,
  Jeroen

---

From: "Bora Akyol" <[email-masked]>
Date: Tue, 12 Sep 2006 11:57:52 -0700

Jeroen

I agree configuring IPSEC on Linux is difficult but that mainly is a
problem with the IPSEC implementation rather than the protocol IMHO.

> Sent: Tuesday, September 12, 2006 9:09 AM
> To: Bora Akyol
> > I think it is a VERY poor excuse to say that we can not configure 
> > IPSEC and therefore it can not be used.
> 
> Just to clarify, I didn't say "we can't configure IPSEC", 
> just that it is a difficult process to configure it. Most 
> IPSEC setups that I came across where done host<->host, and 
> in that field IPSEC is really not so easy to configure.
> 
> Afaik most of the current IPFIX implementations (at least the 
> ones showing up at the interop), collector and meter side, 
> run on Linux/BSD based hosts, not on the routers in between. 
> As such the host needs to be configured. Notez bien that the 
> moment one configures IPSEC between two routers to protect a 
> link one is effectively making a tunnel. IPFIX over

---

From: "Bora Akyol" <[email-masked]>
Date: Tue, 12 Sep 2006 11:57:52 -0700

Jeroen

---

From: Jeroen Massar <[email-masked]>
Date: Wed, 13 Sep 2006 00:57:29 +0200

> problem with the IPSEC implementation rather than the protocol IMHO.

I didn't say anything else ;)
Good that we are on the same line again though :)

Greets,
  Jeroen

---

From: Jeroen Massar <[email-masked]>
Date: Wed, 13 Sep 2006 00:57:29 +0200

Greets,
  Jeroen

---

From: Nevil Brownlee <[email-masked]>
Date: Wed, 13 Sep 2006 02:56:29 -0700

Hi Bora:

Seems to me it would be very useful for the WG to have someone write
a set of IPSEC configs that could be used with IPFIX.  Could you
manage to write a few paragraphs that might be used in the Protocol
Draft Security Considerations section, showing *how* one would
set up IPSEC to run IPFIX, especially how to use IPSEC for IPFIX over an
SCTP-PR transport ?

Cheers, Nevil

> configuration and I will see what I can do to help you.

-----------------------------------------------------------------------
   Nevil Brownlee                 Computer Science Department | ITSS
   Phone: +64 9 373 7599 x88941           The University of Auckland
   FAX: +64 9 373 7453      Private Bag 92019, Auckland, New Zealand

---

From: Nevil Brownlee <[email-masked]>
Date: Wed, 13 Sep 2006 02:56:29 -0700

Hi Bora:

Cheers, Nevil

---

From: Benoit Claise <[email-masked]>
Date: Thu, 21 Sep 2006 00:25:37 +0200

Nevil,

I thought we decided at the last meeting that we should follow what the 
syslog working group would chose.
http://ipfix.doit.wisc.edu/archive/3424.html

    There are also security concerns; it was suggested since most of our
    security concerns are the same as syslog's, we should consider
    adopting their approach to security.

And the syslog WG selected TLS...

Regards, Benoit.

---

From: Benoit Claise <[email-masked]>
Date: Thu, 21 Sep 2006 00:25:37 +0200

Nevil,

Regards, Benoit.

---

From: Nevil Brownlee <[email-masked]>
Date: Thu, 21 Sep 2006 12:05:44 +1200

Hi Benoit:

> I thought we decided at the last meeting that we should follow what 
> the syslog working group would chose.

You're right, of course.  However, Bora raised the question "couldn't
we just use IPsec?"   I suggested he could perhaps write a few
paragraphs explaining how to use IPsec to secure an IPFIX connection,
not because I want to change our current consensus for TLS, but
because if we can get some text explaining how to do it with IPsec,
- it would give IPFIX users two methods rather than only one, and
- it should be usable for SCTP-PR now.

Do please press on with new text for securing IPFIX using TLS.

Cheers, Nevil

-----------------------------------------------------------------------
This mail sent through University of Auckland http://www.auckland.ac.nz

---

From: Nevil Brownlee <[email-masked]>
Date: Thu, 21 Sep 2006 12:05:44 +1200

Cheers, Nevil

---

From: Benoit Claise <[email-masked]>
Date: Thu, 21 Sep 2006 11:42:51 +0200

Hi Nevil,

Thanks for the clarification.

Bora,
Do you plan to write such a section? In which timeframe?

Regards, Benoit.

---

From: Benoit Claise <[email-masked]>
Date: Thu, 21 Sep 2006 11:42:51 +0200

Hi Nevil,

Bora,

Regards, Benoit.