Subject: [IPsec] New version of IPsec Cluster Solution Draft posted [earliar, HA design team started]

From: Raj Singh <[email-masked]>
Date: Mon, 19 Jul 2010 15:54:14 +0530

Hi Group,

We have come up with new version of the "IPsec Cluster Solution"draft
addressing comments which we got, the new version can be find here:
http://trac.tools.ietf.org/wg/ipsecme/trac/wiki/TempDocs.<http://trac.tools.ietf.org/wg/ipsecme/trac/wiki/TempDocs>
We will submit the draft as soon as submission window re-opens.
Please read the draft and give you comments before Maastricht meeting.

Regards,
Raj

On Sun, Jul 11, 2010 at 4:39 PM, Raj Singh <[email-masked]> wrote:

> Hi Group,
>
> We would like to present the HA design team's output for IPsec Cluster
> Solution Draft before Maastricht meeting as
> http://tools.ietf.org/id/draft-kagarigi-ipsecme-ikev2-windowsync-03.txt
>
> This draft solves the main issues of IPsec Cluster Problem Statement draft
> using a simple IKEv2 protocol extension, and  provides implementation advice
> for other issues.
>
> I sincerely thanks all the team members of HA Design Team for attending all
> internal meetings and giving their valuable inputs and doing reviews.
> My special thanks to Yaron and Yoav for their expert inputs and comments. I
> would also like to thanks Paul for providing TeamSpeak server for conducting
> internal design team meetings.
>
> The team started with these draft as inputs.
> 1. http://tools.ietf.org/html/draft-kagarigi-ipsecme-ikev2-windowsync-00 -
> G. Kalyani
> 2.
> http://www.ietf.org/id/draft-arora-ipsecme-ikev2-alt-tunnel-addresses-00.txtJ. Arora
> 3. http://www.ietf.org/id/draft-ietf-ipsecme-ipsec-ha-09.txt - Y. Nir - As
> Input
>
> The current draft is based on [1], then it got enhanced and extended with
> all team's contribution.
> The problem and solution presented in [2], is more towards load balancing
> than HA cluster.
> Also this problem can be solved using IKEv2 REDIRECT mechanism. Also, this
> solution requires IKEv2
> protocol change. So, this is deferred for now.
>
> I request the IPsecME group members to review and give comments on
> http://tools.ietf.org/id/draft-kagarigi-ipsecme-ikev2-windowsync-03.txt,
> so that we can discuss this draft with more details in Maastricht meeting.
>
> Regards,
> Raj Singh
>
> On Fri, Jun 18, 2010 at 11:56 AM, Yaron Sheffer <[email-masked]>wrote:
>
>> Hi,
>>
>> As promised, we have started a design team on IPsec HA. Paul and I have
>> asked Raj Singh to lead the team. His job is to make sure that the team
>> meets regularly in the next few weeks, and produces a good output document
>> before the Maastricht face-to-face meeting.
>>
>> The initial membership of the team is:
>>
>> - Raj Singh ([email-masked], lead)
>>
>> - Jitender Arora ([email-masked])
>> - Min Huang ([email-masked])
>> - Dacheng Zhang ([email-masked])
>> - Yoav Nir ([email-masked])
>> - Yaron Sheffer ([email-masked], observer)
>>
>> According to IETF rules (see
>> http://www.ietf.org/iesg/statement/design-team.htm), every design team
>> needs to have a mission statement. So here it is:
>>
>> Produce a high-level solution document that covers most or all of the
>> issues raised by the HA problem statement (draft-ietf-ipsecme-ipsec-ha). Any
>> solution should be applicable to different deployments, in order to
>> accommodate the variety of existing and future IPsec products. Solutions
>> should have a similar level of security as the IKE/IPsec suite.
>>
>> Another process reminder: the design team's output serves as input to the
>> full WG, essentially like an individual draft. So all protocol decisions
>> will eventually be made by the working group.
>>
>> Thanks,
>>        Yaron
>>
>> _______________________________________________
>> IPsec mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/ipsec
>>
>
>

---

From: Yaron Sheffer <[email-masked]>
Date: Mon, 19 Jul 2010 19:08:49 +0300

Hi everyone,

Please note that most of the discussion in Maastricht will be around 
this draft, so you are strongly encouraged to read it.

For those who cannot make it to Holland, please use the IETF audio 
streaming to listen in, and Jabber to participate in real time. More 
details here: http://www.ietf.org/meeting/78/remote-participation.html. 
We will *not* have WebEX for IPsecME this time.

Thanks,
	Yaron

On 07/19/2010 01:24 PM, Raj Singh wrote:
> http://trac.tools.ietf.org/wg/ipsecme/trac/wiki/TempDocs.
> <http://trac.tools.ietf.org/wg/ipsecme/trac/wiki/TempDocs>
> On Sun, Jul 11, 2010 at 4:39 PM, Raj Singh <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>     Hi Group,
>
>     We would like to present the HA design team's output for IPsec
>     Cluster Solution Draft before Maastricht meeting as
>     This draft solves the main issues of IPsec Cluster Problem Statement
>     draft using a simple IKEv2 protocol extension, and  provides
>     implementation advice for other issues.
>
>     I sincerely thanks all the team members of HA Design Team for
>     attending all internal meetings and giving their valuable inputs and
>     doing reviews.
>     My special thanks to Yaron and Yoav for their expert inputs and
>     comments. I would also like to thanks Paul for providing TeamSpeak
>     server for conducting internal design team meetings.
>
>     1.
>     http://tools.ietf.org/html/draft-kagarigi-ipsecme-ikev2-windowsync-00 -
>     G. Kalyani
>     2.
>     3. http://www.ietf.org/id/draft-ietf-ipsecme-ipsec-ha-09.txt - Y.
>     Nir - As Input
>
>     The current draft is based on [1], then it got enhanced and extended
>     with all team's contribution.
>     The problem and solution presented in [2], is more towards load
>     balancing than HA cluster.
>     Also this problem can be solved using IKEv2 REDIRECT mechanism.
>     Also, this solution requires IKEv2
>     On Fri, Jun 18, 2010 at 11:56 AM, Yaron Sheffer
>     <[email-masked] <mailto:[email-masked]>> wrote:
>
>         Hi,
>
>         As promised, we have started a design team on IPsec HA. Paul and
>         I have asked Raj Singh to lead the team. His job is to make sure
>         that the team meets regularly in the next few weeks, and
>         produces a good output document before the Maastricht
>         face-to-face meeting.
>
>         - Raj Singh ([email-masked] <mailto:[email-masked]>, lead)
>
>         - Jitender Arora ([email-masked]
>         <mailto:[email-masked]>)
>         - Min Huang ([email-masked]
>         <mailto:[email-masked]>)
>         - Dacheng Zhang ([email-masked]
>         <mailto:[email-masked]>)
>         - Yoav Nir ([email-masked] <mailto:[email-masked]>)
>         - Yaron Sheffer ([email-masked]
>         <mailto:[email-masked]>, observer)
>
>         http://www.ietf.org/iesg/statement/design-team.htm), every
>         design team needs to have a mission statement. So here it is:
>
>         Produce a high-level solution document that covers most or all
>         of the issues raised by the HA problem statement
>         (draft-ietf-ipsecme-ipsec-ha). Any solution should be applicable
>         to different deployments, in order to accommodate the variety of
>         existing and future IPsec products. Solutions should have a
>         similar level of security as the IKE/IPsec suite.
>
>         Another process reminder: the design team's output serves as
>         input to the full WG, essentially like an individual draft. So
>         all protocol decisions will eventually be made by the working group.
>
>         Thanks,
>                 Yaron
>
>         [email-masked] <mailto:[email-masked]>

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 19 Jul 2010 10:02:31 -0700

First off: thank you to the design team for the work you put into this. The rest of the WG didn't see this, but the group worked hard and met often.

One of the things that interests me as chair is: does this proposed protocol meet the requirement set out in our RFC-to-be <http://www.ietf.org/internet-drafts/draft-ietf-ipsecme-ipsec-ha-09.txt>? If not, what is missing, and can it be added easily to the proposed protocol?

This will definitely be one of the points of discussion a week from now in Maastricht, but folks can start discussing it here on the list now in preparation for the meeting.

--Paul Hoffman, Director
--VPN Consortium

---

From: Yaron Sheffer <[email-masked]>
Date: Mon, 19 Jul 2010 20:26:09 +0300

Sec. 3 of the draft lists each of the issues described in the Problem 
Statement, and explains how it is resolved.

Thanks,
	Yaron

On 07/19/2010 08:02 PM, Paul Hoffman wrote:
> One of the things that interests me as chair is: does this proposed protocol meet the requirement set out in our RFC-to-be<http://www.ietf.org/internet-drafts/draft-ietf-ipsecme-ipsec-ha-09.txt>? If not, what is missing, and can it be added easily to the proposed protocol?
>

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 19 Jul 2010 10:41:54 -0700

At 8:26 PM +0300 7/19/10, Yaron Sheffer wrote:
>Sec. 3 of the draft lists each of the issues described in the Problem Statement, and explains how it is resolved.

Exactly right. The question to the group is: do you agree with the matching? If not, what do you see as the differences?

--Paul Hoffman, Director
--VPN Consortium

---

From: Yoav Nir <[email-masked]>
Date: Tue, 20 Jul 2010 09:41:15 +0300

I'd like to point out that section 3 is kind of skeletal at this point, and I expect that in the final document, each bullet point will be expanded to its own subsection. I think in the end, section 3 will contain most of the volume of the document.

We've found that (at least in our opinion) most of the problems in the PS document can be addressed with a particular interpretation of the existing standards, rather than new protocol extensions. The exception is expanded in section 4.  In future iterations of the document (hopefully as a WG document) each of the bullet points in section 3 will be expanded to a subsection with MUSTs and SHOULDs for both the cluster implementation and its peers.

Of course, discussion in the group may lead to a realization that creative interpretation of existing documents is not enough. In that case more extension can be proposed and added to the document, much the same way that more problems were added to the PS draft after Anaheim.

On Jul 19, 2010, at 8:41 PM, Paul Hoffman wrote:

> Scanned by Check Point Total Security Gateway.

---

From: "Yoav Nir" <[email-masked]>
Date: Tue, 20 Jul 2010 01:41:15 -0500

WARNING: contains banned part

Subject: Re: [IPsec] New version of IPsec Cluster Solution Draft posted [earliar, HA design team started]
From: "Yoav Nir" <[email-masked]>
To: "Paul Hoffman" <[email-masked]>
Cc: "IPsecme WG" <[email-masked]>
Date: Tue, 20 Jul 2010 01:41:15 -0500