Subject: RE: [Rserpool] RE: Erik Guttman's comments on Rserpool threats f or review and comment

From: [email-masked]
Date: Wed, 5 Sep 2001 16:19:51 +0300

Hi all,

> > (2) To enable the same SA across multiple servers, and share the
> > security context across them. In this case, if the primary SA fails,
> > then a seamless transfer to the other servers is possible since the
> > security context is synchronized.
> 
> Actually its easier than you think.  Since this is network layer
> security, a break in the flow of communication can be handled by
> the transport layer.  The security state associated with the IPsec
> communication flow can be initialized & established with a different
> flow - to a different agent, in the case where RSERPOOL decides to
> redirect traffic.  The challenge is still at the higher layers -
> doing application state context transfer.

[diagram clipped]

> > I think that we will have to leverage off efforts within seamoby for
> > this, and adapt it to rserpool's needs.
> 
> I am not sure this is necessary.  We are not trying to make PE1 and
> PE2 seem equivalent or fix changes due to communication context.
> The seamoby problem is to maintain communication between the same
> endpoints when a mobile host's communication context changes (ie.
> their care of address, the forwarding path, etc.)  The RSERPOOL 
> problem is to allow upper layer flexibility via different transport
> paths.  The network layer is largely isolated from this.  Indeed,
> a transport like SCTP will allow transparent recovery across 
> different L3 endpoints (with distinct security associations) as a
> service to higher layers.

Erik, I'm with you on this one.  I think if we don't need to 
pass application state, Erik's proposal will work nicely.  

Also, I'd suggest holding off on Application state transfer - 
I believe it is outside of our charter.

Finally, I wouldn't suggest planning to leverage anything off of
SeaMoby for a long, long time.

best regards,
John

_______________________________________________
rserpool mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/rserpool