Subject: RE: draft-touch-ipsec-vpn-06.txt

From: "Claudio Lordello" <[email-masked]>
Date: Fri, 23 Jan 2004 14:42:23 -0500

Joe Touch wrote:
> > 
> >>While there are ways to have (as with 2401) an 
> implementation that is 
> >>IPsec-2401bis compliant that handles dynamic routing using 
> >>tunnel-mode 
> >>SAs, it's not ensured. It is ensured that transport mode with 
> >>non-IPsec 
> >>tunnels will always accommodate dynamic routing.
> > 
> > That's my point. So you agree that tunnel mode and routing are
>  > not necessarily mutually exclusive, and yet your drafts states
>  > that in several occasions.
> > 
> > Claudio.
> 
> Reliable transport and UDP are not mutually exclusive either. 
> IF all the 
> packets get there. You cannot rely on an implementation conformant to 
> the spec to support dynamic routing - on that information alone.
> 

Yes, the same way you cannot say that another implementation, also conformant to the spec, cannot support dynamic routing. Yet you do.

Regarding you example, the difference is that UDP is clearly stated as an unreliable. Assuming otherwise is a mistake. On the other hand, 2401 does not state that tunnel mode cannot be used in dynamic routing environments.

> Our assertion - and the whole document - focuses on the spec. As I've 
> already stated, implementation variations outside the spec 
> that cannot 
> be relied upon are important as possible mods to the spec only. And 
> that's how we discuss them.
> 

Why "outside the spec"? How can you say that when also you agreed that "there are ways to have an implementation that is IPsec-2401bis compliant that handles dynamic routing using tunnel-mode SAs"? 

Claudio.

---

From: Joe Touch <[email-masked]>
Date: Fri, 23 Jan 2004 13:23:23 -0800

> Yes, the same way you cannot say that another implementation, also conformant to the spec, cannot support dynamic routing. Yet you do.

The doc doesn't talk about implementations - it talks about specs, and 
should.

> Regarding you example, the difference is that UDP is clearly stated as an unreliable.
 > Assuming otherwise is a mistake.

Assuming that a compliant 2401 implementation can support dynamic 
routing is equally erroneous.

...
> Why "outside the spec"? How can you say that when also you agreed that
 > "there are ways to have an implementation that is IPsec-2401bis compliant
 > that handles dynamic routing using tunnel-mode SAs"?
> 
> Claudio. 

MUST vs. MAY, in a sense. We're talking about what needs (MUST) be done 
so that the user can rely on dynamic routing working.

Joe