Subject: re: Issue #68: VPNs with overlapping IP address ranges (was Re: 2401bis issues (possible) resolution)

From: Ken Carlberg <[email-masked]>
Date: Wed, 08 Oct 2003 19:42:04 +0100

> I do not think there is any need to negotiate the VPN subscriber ID
> between the parties. The VPN subscriber ID is internal to the SGW, and
> it is not going to trust anything the other end sends.

I would disagree with the above comment.

we developed an incremental VPN capability with one of our gateways
that used a third party manager to add/remove participants from the
VPN, and thus included participant(s) outside of the SGW.  accordingly,
we used and exchanged a VPN subscriber ID to accomplish this.

assuming I haven't misunderstood the basis of the thread on Issue #68, 
the VPN ID feature feature was fundamental in our work and it would be
nice to not see it set aside as an implementation issue.

regards,

-ken

---

From: Tero Kivinen <[email-masked]>
Date: Thu, 9 Oct 2003 11:37:00 +0300

> we used and exchanged a VPN subscriber ID to accomplish this.

I do not disagree with that. You can do that with VPN ID, but I say
you can also do it without VPN IDs. 
-- 
[email-masked]
SSH Communications Security                  http://www.ssh.fi/
SSH IPSEC Toolkit                            http://www.ssh.fi/ipsec/