Subject: RE: draft-fang-ppvpn-security-framework-01

From: "Michael H. Behringer" <[email-masked]>
Date: Fri, 08 Aug 2003 21:29:01 +0200

Ron, Paul,

Well, "the central network infrastructure over which PPVPN services are 
delivered" includes PE routers in my reading. You deliver a PPVPN service 
specifically from a PE router, right?

What if I change it to "A PPVPN core network is defined here as the central 
network infrastructure (P and PE routers) over which PPVPN services are 
delivered."?

I don't like to talk about a SP network, because a PPVPN core may consist 
of more than one SP network, right? I guess I could write after the above 
sentence: "A PPVPN core network consists of one or more SP networks."

Hmmm... After various comments on that paragraph I have done so much 
wordsmithing on it, that I think it is best to copy it here, so that you 
can see yourself:

---
A PPVPN core network is defined here as the central network infrastructure 
(P and PE routers) over which PPVPN services are delivered. A PPVPN core 
network consists of one or more SP networks. All network elements in the 
core are under the operational control of one or more PPVPN service 
providers. Even if the PPVPN core is provided by several service providers, 
towards the PPVPN users it appears as a single zone of trust. However, 
several service providers providing together a PPVPN core still need to 
secure themselves against the other providers. PPVPN services can also be 
delivered over the Internet, in which case the Internet forms a logical 
part of the PPVPN core.
---

The ASCII art BTW is meant to show zones of trust nothing more.

What do you think?

Thanks,
Michael

At 14:53 30/07/2003, Ron Bonica wrote:
>Paul,
>
>You may be right. However, I would not have infered that meaning from the
>following definition
>which was lifted from draft-fang-ppvpn-security-framework
>
>    "A PPVPN core network is defined here as the central network
>    infrastructure over which PPVPN services are delivered. All network
>    elements in the core are under the operational control of one or
>    more PPVPN service providers. PPVPN services can also be delivered
>    over the Internet, in which case the Internet forms a logical part
>    of the PPVPN core."
>
>If that was the meaning of this paragraph, it should include some specific
>verbage excluding PE routers. Then the term becomes significantly different
>from the term "SP network".
>
>                                            Ron
>                                            /individual contributor
>
> > -----Original Message-----
> > From: [email-masked] [mailto:[email-masked]]On Behalf Of
> > Paul Hoffman / VPNC
> > Sent: Tuesday, July 29, 2003 11:45 PM
> > To: Ron Bonica; [email-masked]
> > Subject: RE: draft-fang-ppvpn-security-framework-01
> >
> >
> > At 9:00 PM -0400 7/29/03, Ron Bonica wrote:
> > >Paul
> > >
> > >Doesn't draft-ietf-l3vpn-framework use the term "SP Network"?
> > Isn't that the
> > >same as the "core network"?
> >
> > It doesn't appear to be. In the l3vpn-framework document, it appears
> > that the "SP Network" include the PE boxes, but in the
> > security-framework document, the "core network" does not. That's a
> > pretty significant difference when you are trying to delineate where
> > various security services happen.
> >
> > Of course, I could be reading one or both of the documents wrong,
> > particularly because the l3vpn-framework document doesn't directly
> > define "SP network": you have to infer it from the ASCII art.
> >
> > --Paul Hoffman, Director
> > --VPN Consortium
> >

---

From: Ron Bonica <[email-masked]>
Date: Sun, 10 Aug 2003 16:40:04 -0400

much better! Thanks for the clarification.

                 -r

> Michael H. Behringer
> Sent: Friday, August 08, 2003 3:29 PM
> To: Ron Bonica; Paul Hoffman / VPNC; [email-masked]