Subject: Re: [IPsec] Deep Inspecting ESP-NULL Packets

From: [email-masked]
Date: Tue, 2 Dec 2008 15:26:43 -0800 (PST)

An additional dimension to this analysis is related to scenarios. Splitting the world between 
nodes and middleboxes may not capture the whole thing. For example, a middlebox in, say, 
a branch office scenario may have much less of a scalability problem than the middlebox 
sitting in front of a datacenter on a 10Gbps link. The answer from the middlebox dude probably
differs depending on which scenario they are contemplating.

----- Original Message ----
> From: "Grewal, Ken" <[email-masked]>
> To: Dan McDonald <[email-masked]>; "[email-masked]" <[email-masked]>
> Sent: Tuesday, December 2, 2008 1:55:39 PM
> Subject: Re: [IPsec] Deep Inspecting ESP-NULL Packets
> 
> LOL - Nice analysis :-)
> 
> If we want a common solution amenable to all parties, without letting the 'other 
> guy' worry about it, we need a common language, hence the new protocol. 
> 
> BTW, some of your text appears encrypted (*&^%&%$#) - any pointers on how to 
> parse this? ;-)
> 
> Thanks, 
> - Ken
> 
> 
> >-----Original Message-----
> >From: [email-masked] [mailto:[email-masked]] On Behalf Of
> >Dan McDonald
> >Sent: Tuesday, December 02, 2008 10:53 AM
> >To: [email-masked]
> >Subject: Re: [IPsec] Deep Inspecting ESP-NULL Packets
> >
> >
> >> That said, the previous emails seemed to indicate that the heuristic
> >> approach would not require any retooling.  Can someone explain that
> >> magic to me?
> >
> >The problem with any deep-inspection-friendly ESP comes down to two
> >complaints from two mostly-disjoint sets of developers:
> >
> >End-node/OS types:
> >------------------
> >
> >I'm not putting in a THIRD IPsec protocol (or SECOND if I blew off AH) if I
> >can help it.  I put in IPv6 a while ago and not many of my customers/users
> >are using it.  And do you know how hard it is to get customers to
> >*upgrade*?!?  They all want the new features in the same *&^%&%$# revision
> >number so they won't have to pay high-priced con-art^H^H^H^Hsultants to
> >"recertify" their setup.  I thought this whole 430x movement was about
> >*SIMPLIFYING* things!
> >
> >
> >
> >Middlebox/Router/Firewall types:
> >--------------------------------
> >
> >You expect me to go begging to my {silicon vendor, in-house polygon
> >pushers}
> >and put in all sorts of can't-make-it-run-fast inspection that needs to
> >guess?  It's all just software at the end-nodes - let them figure it out!
> >I
> >thought this whole 430x movement was about *SIMPLIFYING* things!
> >
> >
> >
> >My apologies for not injecting enough humor into the 2nd point of view.
> >
> >
> >If anyone's scheme can overcome both of those complaints, we all win.
> >Anything else is going to be painful for someone.  I am a fan of Kivenen's
> >middlebox heuristic scheme, mostly because I fall into the first category
> >of
> >complainers.
> >
> >
> >Dan
> >_______________________________________________
> >IPsec mailing list
> >[email-masked]
> >https://www.ietf.org/mailman/listinfo/ipsec
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec

_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec