Subject: RE: draft-touch-ipsec-vpn-06.txt

From: "Claudio Lordello" <[email-masked]>
Date: Mon, 26 Jan 2004 14:39:33 -0500

> > Joe Touch wrote:
> 
> Claudio Lordello wrote:
> 
> > Joe Touch wrote:
> > 
> >>MUST vs. MAY, in a sense. We're talking about what needs 
> >>(MUST) be done 
> >>so that the user can rely on dynamic routing working.
> >>
> >>Joe
> > 
> > You seem to be exchanging "MUST"'s and "MAY"'s. 
>  > The current version of RFC2401bis clearly states that
>  > IPsec SG's MUST implement tunnel mode and only MAY implement 
> transport mode.
> > 
> > Claudio.
> 
> Yes. And where it does not, dynamic routing won't be 
> supported. By since 
> dynamic routing isn't a MUST, neither is transport mode at gateways.
> 
> Joe
> 

OK. In summary: this WG is asking comments as to whether or not it should approve this draft, a draft which states that "IPsec tunnel mode conflict with routing and forwarding inside a VN", when in fact, the only mode that MUST be supported by SG's (i.e., routers), as established by the IPsec WG, is actually tunnel mode.

Claudio.

---

From: Joe Touch <[email-masked]>
Date: Mon, 26 Jan 2004 12:57:46 -0800

Claudio Lordello wrote:

...
> OK. In summary: this WG is asking comments as to whether or not it
> should approve this draft,

Actually, since it's not a WG doc, the 'approval' isn't the option.

What's being asked is whether the WG has issues with the doc in its 
current for, notably issues central to L3VPN.

> a draft which states that "IPsec tunnel mode
> conflict with routing and forwarding inside a VN", when in fact, the
> only mode that MUST be supported by SG's (i.e., routers), as established
> by the IPsec WG, is actually tunnel mode.

That is an excellent point that has already been taken up with the IPsec 
WG. Your participation in that WG - notably on the update to RFC2401, 
would have been useful.

Joe