Subject: [IPFIX] IPFIX configuration: Call for TLS/DTLS parameters

From: Gerhard Muenz <[email-masked]>
Date: Thu, 23 Oct 2008 18:13:01 +0200

Hi,

Are there any people/groups - apart from Brian - how have implemented
TLS/DTLS for IPFIX (or other flow export protocols)?
Does anybody know any commercial products supporting this feature?

If yes, please give feedbackk to the following questions:

Does it make sense to include TLS/DTLS parameters into the IPFIX
configuration model?
If so, which are the most important parameters to be included?

Regards,
Gerhard

_______________________________________________
IPFIX mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipfix

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Thu, 23 Oct 2008 19:48:42 +0200

> If so, which are the most important parameters to be included?

I have not implemented any of this. However, I suggest avoiding going
into any DTLS/TLS configuration details as this is something that
should be worked out by DTLS/TLS WGs.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>
_______________________________________________
IPFIX mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/From [email-masked]  Thu Oct 23 10:47:33 2008
Date: Thu, 23 Oct 2008 19:48:42 +0200
From: Juergen Schoenwaelder <[email-masked]>
To: Gerhard Muenz <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [IPFIX] IPFIX configuration: Call for TLS/DTLS parameters
Reply-To: [email-masked]
Sender: [email-masked]

> If so, which are the most important parameters to be included?

I have not implemented any of this. However, I suggest avoiding going
into any DTLS/TLS configuration details as this is something that
should be worked out by DTLS/TLS WGs.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>
_______________________________________________
IPFIX mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipfix

ipfix

---

From: Paul Aitken <[email-masked]>
Date: Fri, 31 Oct 2008 14:59:45 +0000

Gerhard,

Juergen Schoenwaelder wrote:

> I have not implementFrom [email-masked]  Fri Oct 31 07:59:50 2008
Date: Fri, 31 Oct 2008 14:59:45 +0000
From: Paul Aitken <[email-masked]>
To: Gerhard Muenz <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [IPFIX] IPFIX configuration: Call for TLS/DTLS parameters
Sender: [email-masked]

Gerhard,

Juergen Schoenwaelder wrote:

> I have not implementeded any of this. However, I suggest avoiding going

Perhaps these should addressed by vendor-specific parameters in a 
similar way to ACLs, per the discussion with Atsushi-san?

-- 
Paul Aitken
Cisco Systems Ltd, Edinburgh, Scotland.
_______________________________________________
IPFIX mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipfix

 any of this. However, I suggest avoiding going
> should be worked out by DTLS/TLS WGs.

Perhaps these should addressed by vendor-specific parameters in a 
similar way to ACLs, per the discussion with Atsushi-san?

-- 
Paul Aitken
Cisco Systems Ltd, Edinburgh, Scotland.
_______________________________________________
IPFIX mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipfix

---

From: Brian Trammell <[email-masked]>
Date: Fri, 31 Oct 2008 11:06:46 -0400

All,

Certain TLS/DTLS parameters should of course be vendor-specific. But  
many of these (e.g. X.509 certificate authorities and subject  
certificates, PKCS#12 "client" (EP) certs, and so on) should be  
commonly represented among all implementations, especially given the  
fairly stringent requirements on mutual identification in 5101. So I  
would suggest that _at least_ the EP/CP identity, the authorized-CP  
identity for EPs, and authorized-EP or authorized-EP-cert-authority  
for CPs, be addressed in the configuration data model.

Cheers,

Brian

---

From: Brian Trammell <[email-masked]>
Date: Fri, 31 Oct 2008 11:06:46 -0400

All,

Cheers,

Brian