Subject: [OPSAWG] bootstrapping devices via VPNs

From: Juergen Schoenwaelder <[email-masked]>
Date: Mon, 28 Mar 2011 09:58:51 +0200

Hi,

as mentioned today in the OPSAWG meeting, there is one open item in
draft-ietf-opsawg-automated-network-configuration-00 where I am
looking for input. The scenario is as follows:

  A device, after picking up basic IP connectivity (e.g. via DHCP) and
  before looking for a configuration server, sets up a VPN in order to
  tunnel traffic into the service provider's network.

I am looking for input whether this is done somewhere in practice and
if so I would very much appreciate pointers to any relevant documents
or simply help in writing text describing details how this works.

If I do not receive concrete input in the coming say three weeks, I
will remove the open issue from the docment since this usage of VPNs
might not be operationally relevant and I prefer to finish up this
document.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: Christopher LILJENSTOLPE <[email-masked]>
Date: Mon, 28 Mar 2011 22:13:08 +1100

<hat off>

I am not aware of any devices in our environment (or other environments I am aware of) that follow this model, so, in my vote, this is a NOOP.

	Chris

</hat off>

On 28Mar2011, at 18.58, Juergen Schoenwaelder wrote:

> _______________________________________________
> OPSAWG mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsawg

---
李柯睿
Check my PGP key here:
https://www.asgaard.org/~cdl/cdl.asc

---

From: Joel Jaeggli <[email-masked]>
Date: Mon, 28 Mar 2011 05:39:02 -0700

I've had devices that in fact do build a tunnel following dhcp and prior
to the point where they configure themeselves. they located the tunnel
endpoint either relying on preconfiguration, dhcp option or DNS rrs to
locate the controller... aruba controllers/APs do this.

On 3/28/11 4:13 AM, Christopher LILJENSTOLPE wrote:
> <hat off>
> 
> I am not aware of any devices in our environment (or other environments
> I am aware of) that follow this model, so, in my vote, this is a NOOP.
> 
> Chris
> 
> </hat off>
> 
>> [email-masked] <mailto:[email-masked]>

---

From: Christopher LILJENSTOLPE <[email-masked]>
Date: Mon, 28 Mar 2011 23:56:42 +1100

I stand corrected.  Any thoughts on what Juergen may need to consider?

	Chris

---
李柯睿
Check my PGP key here:

---

From: huang cancan <[email-masked]>
Date: Tue, 29 Mar 2011 09:45:39 +0800

hi, Juergen:
   I haven't attend the 80th IETF, so may I ask in which scenario this
function should be used? Why some devices need to tunnel traffic into the
service provider's network before configuration?

Thanks!

Cancan Huang
China Telecom

---

From: Joel Jaeggli <[email-masked]>
Date: Tue, 29 Mar 2011 05:26:11 -0700

> I stand corrected.  Any thoughts on what Juergen may need to consider?

so the question normally applied to such a scenario, is building a
tunnel before you've established a trust relationship implies
pre-configuration or blind trust, the latter obviously has some
limitations, they may be acceptable (pretty good security or ssh as an
example is illustrative) but it certainly should be used as a general
bootstrapping method post initial configuration.

>>>> [email-masked] <mailto:[email-masked]> <mailto:[email-masked]>

---

From: Christopher LILJENSTOLPE <[email-masked]>
Date: Tue, 29 Mar 2011 23:45:18 +1100

Thank's Joel

	Chris

---
李柯睿
Check my PGP key here:

---

From: Joel Jaeggli <[email-masked]>
Date: Tue, 29 Mar 2011 05:55:50 -0700

> example is illustrative) but it certainly should be used as a general
                                                  ^
 should (not) be