Subject: Announcing X-Bone VPN/overlay software release

From: Joe Touch <[email-masked]>
Date: Fri, 17 Mar 2000 14:23:52 -0800 (PST)

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx    
   x                                                          x    
   x           XX    XX      X-BONE Overlay System            x    
   x             X  X                                         x    
   x              XX                Software Release          x    
   x             X  X                                         x    
   x           XX    XX             March 2000                x    
   x                                                          x    
   xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx    

The X-Bone system for automated deployment of VPN / overlay networks
is now publicly available. This is the first major public release, v1.2.
                                                                   
X-Bone dynamically deploys and manages Internet overlays to reduce
configuration effort and increase network component sharing. X-Bone
discovers, configures, and monitors network resources to create
overlays over existing IP networks.
                                                                   
The X-Bone is implemented in Perl, and open source is provided.
                                                                   
The X-Bone can be used for:                                        
                                                                   
      - deploying VPNs                                             
                                                                   
      - sharing lab or wide-area networks                          
         for multiple, concurrent projects                         
         for testing protocols and apps on new topologies          
                                                                   
X-Bone uses two-layer IP in IP tunneled overlays and supports existing
applications and unmodified routing, multicast, and DNS services.
X-Bone also support IPSec within overlays. Applications can use the
X-Bone without modification or recompilation.
                                                                   
The X-Bone is available for the following operating systems:       
                                                                   
      - FreeBSD                                                    
              CAIRN 2.5, 3.*, 3.* + KAME IPsec patches             
                                                                   
      - Linux RedHat                                               
              6.0, 6.0 + NIST Cerberus IPsec patches, 6.1          
                                                                   
The FreeBSD port and Linux RPM have been submitted to the FreeBSD
ports and RedHat Linux RPMs sites; further information and details and
the port and RPM files are currently available at:
                                                                   
      http://www.isi.edu/xbone/                                    
                                                                   
- Joe Touch                                                        
  Project Leader, X-Bone group, USC/ISI                            
  [email-masked]                                                    
  http://www.isi.edu/touch                                         
  +1 (310) 448-9151                                                
                                                                   
-------------------------------------------------------------------
 Effort sponsored by the Defense Advanced Research Projects Agency 
 (DARPA)and Air Force Research Laboratory, Air Force Materiel      
 Command, USAF, under agreement number F30602-98-1-0200.           
                                                                   
 Copyright (c) 1998-2000 by the University of Southern California. 
 All rights reserved.                                              
-------------------------------------------------------------------

---

From: Joe Touch <[email-masked]>
Date: Fri, 17 Mar 2000 15:52:12 -0800

To clarify: 

	We're hoping this tool will be useful for researchers
	in deploying testbeds and configuring web (and other) 
	experiments.

	- Joe

---

From: George Michaelson <[email-masked]>
Date: Sat, 18 Mar 2000 10:58:32 +1000

Its very unfair to comment or critique from a sketchy reading
but I'm drawn to the issue of double ip-in-ip wrapping. My
experience of running VPN over 10/34Mb bandwidth is that with
the current FreeBSD technology I can't exceed 2mbit bandwidth
in the VPN, using blowfish-cbc. I also suffer pretty severe
fragmentation issues with some protocols. Mbone is fine, netmeeting
isn't. telnet is fine, web is fine, NFS isn't.

Don't you find that excess IPSEC wraps cost you severely? Maybe
I'm confusing architectural must-haves with operational issues.

(tangential to wrec, nice code! I definately want to play with it,
 thanks for releasing it)

more WREC relevant: how many of us will be at IETF? Did we resolve
the issue of the WG meeting status? I will be there. Lets caucus
if nothing else...

cheers
	-George
--
George Michaelson         |  DSTC Pty Ltd
Email: [email-masked]    |  University of Qld 4072
Phone: +61 7 3365 4310    |  Australia
  Fax: +61 7 3365 4311    |  http://www.dstc.edu.au

---

From: Joe Touch <[email-masked]>
Date: Fri, 17 Mar 2000 17:04:32 -0800

> isn't. telnet is fine, web is fine, NFS isn't.

I take this as more of a criticsm of IPsec; we didn't invent
that, we just use it. The double-wrapping is IPIP; the IPsec
stuff happens only once for the overlay. Our measurements
of IPIP decapsulation overheads are measureable (10% or so
on 200 Mhz P-II's), but not too bad. It's a trade-off -
for that performance penalty, you get dynamically-deployed networks.

Fragmentation may occur; we're looking into whether 
(and to what extent) PMTU fixes that. 
> I'm confusing architectural must-haves with operational issues.

As above, we do IPsec once. The web pages explain the
double-wrap in more detail:

	http://www.isi.edu/x-bone/tunneling.html

FWIW...

Joe