Subject: FW: draft-touch-ipsec-vpn-06.txt

From: "Claudio Lordello" <[email-masked]>
Date: Tue, 27 Jan 2004 08:47:28 -0500

reposting...

> 
> ...
> > OK. In summary: this WG is asking comments as to whether or not it
> > should approve this draft,
> 
> Actually, since it's not a WG doc, the 'approval' isn't the option.
> 
> What's being asked is whether the WG has issues with the doc in its 
> current for, notably issues central to L3VPN.
> 

Well, hopefully is very clear by now that I do have an issue with this draft on its current format, and I have clearly stated what exactly my issue is on previous emails.

> > a draft which states that "IPsec tunnel mode
> > conflict with routing and forwarding inside a VN", when in fact, the
> > only mode that MUST be supported by SG's (i.e., routers), 
> as established
> > by the IPsec WG, is actually tunnel mode.
> 
> That is an excellent point that has already been taken up 
> with the IPsec 
> WG. Your participation in that WG - notably on the update to RFC2401, 
> would have been useful.
> 
> Joe
> 

Not at all! I am NOT the one saying that there are issues with running routing protocols over an IPsec tunnel. You are saying that. I am perfectly happy with the MUST's and MAY's currently specified in 2401bis regarding tunnel/transport mode. Actually, I have clearly stated that the implementation I work with does support dynamic routing over an IPsec tunnel, without any of the issues you describe in your draft. 

Claudio.

---

From: Lars Eggert <[email-masked]>
Date: Tue, 27 Jan 2004 15:12:03 +0100

Claudio Lordello wrote:
> 
> Not at all! I am NOT the one saying that there are issues with
> running routing protocols over an IPsec tunnel. You are saying that.
> I am perfectly happy with the MUST's and MAY's currently specified in
> 2401bis regarding tunnel/transport mode. Actually, I have clearly
> stated that the implementation I work with does support dynamic
> routing over an IPsec tunnel, without any of the issues you describe
> in your draft.

Some 2401-compliant implementations *CAN* run dynamic routing over IPsec 
tunnels. Some 2401-compliant implementations *CANNOT*.

I'd call that an issue in the spec with regard to supporting dynamic 
routing. (I don't know how else to explain this any simpler.)

Lars
-- 
Lars Eggert                                     NEC Network Laboratories

---

From: Mark Duffy <[email-masked]>
Date: Tue, 27 Jan 2004 10:38:35 -0500

>routing. (I don't know how else to explain this any simpler.)

The authors of this draft have been making this sort of argument all along 
and to me it makes no sense.  Some ethernet-compliant devices *CAN* support 
IP and some *CANNOT*.  Does anyone think this is a problem with the 
ethernet spec?

-Mark

---

From: Lars Eggert <[email-masked]>
Date: Tue, 27 Jan 2004 17:11:16 +0100

Mark Duffy wrote:
> The authors of this draft have been making this sort of argument all 
> along and to me it makes no sense.  Some ethernet-compliant devices 
> *CAN* support IP and some *CANNOT*.  Does anyone think this is a problem 
> with the ethernet spec?

To stick with your analogy: The Ethernet spec is underspecified when it 
comes to carrying IP traffic, similar to how 2401 is underspecified when 
it comes to dynamic routing. Hence, we have a spec that says "here's how 
you can carry IP over Ethernet and interoperate", similar to how our 
draft does for dynamic routing and IPsec.

(Note that the Ethernet specification did the right thing, and not 
discuss this. IPsec would be cleaner if it did not include its own 
underspecified tunneling mechanism.)

Lars