Subject: RE: draft-touch-ipsec-vpn-06.txt

From: "Claudio Lordello" <[email-masked]>
Date: Fri, 23 Jan 2004 12:14:51 -0500

Joe Touch wrote:
> It is - the specific recommendations are made as 
> standards-track in 2401bis.
> 

Are you saying that 2401bis will "disallow" SG's from using tunnel mode when routing is required? 

> One of the ways isn't consistent with the use of a single SPD.
> 

Sorry but I do not understand how routing over an IPsec tunnel mode is inconsistent with a single SPD, assuming that's what you are saying...

> Second, it was perceived by the IPsec WG that tunnel selectors aren't
> needed in the IP-over-IP case (a special case of L3VPNs). 
> That issue was
> also discussed in the IPsec WG a while ago.

I certainly did miss the IPsec WG thread where tunnel selectors are perceived as not needed.

> 
> Our doc (and the many previous WG discussions) addresses 
> these issues, 
> as well as others that have been raised in detail already.

I am not concerned with "other" issues. I am concerned with statements about IPsec tunnel mode being incompatible with routing. Your doc states that as if it was a general IPsec problem, when I do not believe it is the case.

Claudio.

---

From: Joe Touch <[email-masked]>
Date: Fri, 23 Jan 2004 10:11:33 -0800

> Are you saying that 2401bis will "disallow" SG's from using tunnel mode when routing is required? 

Not explicitly - it specificially allows transport mode for otherwise 
tunneled traffic.

> Sorry but I do not understand how routing over an IPsec tunnel mode
 > is inconsistent with a single SPD, assuming that's what you are saying...

Please see the processing model diagram in 2401bis. The SPD processing 
happens before the forwarding step, very explicitly in this newer model. 
That means a tunnel-mode SA must be picked before dynamic routing comes 
into play.

While there are ways to have (as with 2401) an implementation that is 
IPsec-2401bis compliant that handles dynamic routing using tunnel-mode 
SAs, it's not ensured. It is ensured that transport mode with non-IPsec 
tunnels will always accommodate dynamic routing.

> I am not concerned with "other" issues. I am concerned with
 > statements about IPsec tunnel mode being incompatible with routing.
 > Your doc states that as if it was a general IPsec problem, when I
 > do not believe it is the case.
> 
> Claudio.

The IPsec WG did, which is why this work was presented there several times.

Joe