Subject: Re: revised IPsec processing model: Q: VID and forwarding function

From: Joe Touch <[email-masked]>
Date: Mon, 04 Aug 2003 13:29:53 -0700

Stephen Kent wrote:
> At 9:09 -0700 7/19/03, Ricky Charlet wrote:
> 
>> Hello,
>>
>>     I'm trying to understand the motivations for VIDs and explicit 
>> forwarding function separation. Currently, I am guessing (based on 
>> your first paragraph) that these new features enable PPVPNs and/or 
>> overlay networks. If so, how so? If not, what new functionality is 
>> enabled by these features?
> 
> 
> There was a long series of off-list and post-WG meetings discussions 
> involving folks had expressed concern over how to modify IPsec 
> processing to better accommodate PPVPNs and overlay nets. The grouops 
> included  Mark Duffy, Greg Lebovitz, and Joe Touch I developed this 
> model and vetted it with this group some months ago.

FYI (all):

At best, only the basic concept of doing a forwarding lookup was 
presented during a brief conversation at the Atlanta IETF; I cannot 
speak for the others, but this thread was the first I've seen of this 
proposal, and we certainly were not involved in developing it, or 
participating in a "long series" of meetings about it.

I would not consider it 'vetted', but rather proposed at best. Even at 
that time Lars Eggert and I expressed significant concerns about this 
proposal.

A brief summary of some of those concerns, to the extent that we could 
address them absent a detailed proposal, was discussed in section 4.1.3 
as "Alternative 3" of the final update of our ID on the issue of support 
for dynamic routing in IPsec (draft-touch-ipsec-vpn-05.txt).

Joe

---

From: Stephen Kent <[email-masked]>
Date: Mon, 4 Aug 2003 16:48:47 -0400

At 13:29 -0700 8/4/03, Joe Touch wrote:
>>There was a long series of off-list and post-WG meetings 
>>discussions involving folks had expressed concern over how to 
>>modify IPsec processing to better accommodate PPVPNs and overlay 
>>nets. The grouops included  Mark Duffy, Greg Lebovitz, and Joe 
>>Touch I developed this model and vetted it with this group some 
>>months ago.
>
>FYI (all):
>
>speak for the others, but this thread was the first I've seen of 
>this proposal, and we certainly were not involved in developing it, 
>or participating in a "long series" of meetings about it.

Joe, sorry for the confusion caused by a misplaced "s" in the above 
text. My message was supposed to refer to "post-WG meeting 
discussions."  I think others who read the message interpreted my 
typo as I had intended, and as restated, it is accurate. I did not 
mean to suggest that there were a set of post-WG meetings among the 
interested parties.  We did, however, exchange a number of e-mail 
messages on the topic.

>I would not consider it 'vetted', but rather proposed at best. Even 
>at that time Lars Eggert and I expressed significant concerns about 
>this proposal.
>
>A brief summary of some of those concerns, to the extent that we 
>could address them absent a detailed proposal, was discussed in 
>section 4.1.3 as "Alternative 3" of the final update of our ID on 
>the issue of support for dynamic routing in IPsec 
>(draft-touch-ipsec-vpn-05.txt).

My view is that the majority of the participants in the discussions 
found it an acceptable model, but you and Lars did not.  rough 
consensus?

Steve

---

From: Joe Touch <[email-masked]>
Date: Mon, 04 Aug 2003 13:56:16 -0700

Stephen Kent wrote:
> discussions."  I think others who read the message interpreted my typo 
> as I had intended, and as restated, it is accurate. I did not mean to 
> suggest that there were a set of post-WG meetings among the interested 
> parties.  We did, however, exchange a number of e-mail messages on the 
> topic.

Agreed.

>> address them absent a detailed proposal, was discussed in section 
>> 4.1.3 as "Alternative 3" of the final update of our ID on the issue of 
>> support for dynamic routing in IPsec (draft-touch-ipsec-vpn-05.txt).
> 
> found it an acceptable model, but you and Lars did not.  rough consensus?

I recall only 1-2 other participants in those meetings; it was a quick 
chat over the break, as I recall as well. I wouldn't consider that brief 
discussion sufficient for anyone to establish consensus, certainly not 
based on the absence of detail at that time.

Joe

---

From: Stephen Kent <[email-masked]>
Date: Mon, 4 Aug 2003 17:04:20 -0400

>>>I would not consider it 'vetted', but rather proposed at best. 
>>>Even at that time Lars Eggert and I expressed significant concerns 
>>>about this proposal.
>>>
>I recall only 1-2 other participants in those meetings; it was a 
>quick chat over the break, as I recall as well. I wouldn't consider 
>that brief discussion sufficient for anyone to establish consensus, 
>certainly not based on the absence of detail at that time.
>
>Joe

I was referring to the e-mail messages that were exchanged over a 
several month period, during which I proposed the model, not to any 
in-person discussions. Again, I apologize for the ambiguity of the 
reference to "discussions."

Steve