Subject: [Nea] NEA charter query

From: "Stephen Hanna" <[email-masked]>
Date: Wed, 20 Dec 2006 15:54:45 -0500

Khaja Ahmed recently asked this question of the NEA chairs:
> Given that we cannot discuss requirements that pertain to
> internet wide usage, can we still discuss potential impact
> of such a protocol if it were to be used in place it is not
> designed for? ...i.e. the internet.

The applicability limitation in our charter restricts our focus
to "computing enterprise environments, where endpoints accessing
the enterprise's network are owned and/or expected to conform to
the policies set forth by the organization that owns and operates
the network." But this does not mean that the NEA protocols will
only be carried over the enterprise network. Enterprises often
use protocols over the Internet and it's not unlikely that NEA
protocols might have to transit the Internet in a remote access
scenario (with an appropriate PT).

So we should expect the NEA protocols to be used on the Internet
and include relevant requirements in our requirements document
(security, congestion control, loss, wide variations in round
trip time, etc.). But we should not cover non-enterprise use cases
or situations where the endpoint is not owned by or expected to
conform with the policies of the organization that owns and operates
the network.

Thanks,

Steve

_______________________________________________
Nea mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nea

---

From: Alan DeKok <[email-masked]>
Date: Wed, 20 Dec 2006 13:37:38 -0800

Stephen Hanna wrote:
> ... Enterprises often

  I presume that the enterprise network isn't trusted, either.  So NEA
will have to include security such as SSL inside of the enterprise, too.
 Those security mechanisms can likely be leveraged to work for access
from outside of the enterprise, too.

> trip time, etc.).

  Once a security layer is defined to enable private transport of NEA
information, the security transport protocol takes care of congestion
control, loss, variations in round trip time, etc.  The NEA requirements
should include per-session timeouts on the client & server, but I don't
see why packet congestion control is relevant.

> But we should not cover non-enterprise use cases

  What about the case where the endpoint is not owned by the
organization that operates the network, but is willing to conform with
it's policies?

  Alan DeKok.
--
  http://deployingradius.com       - The web site of the book
  http://deployingradius.com/blog/ - The blog

---

From: "Mike Fratto" <[email-masked]>
Date: Wed, 20 Dec 2006 19:35:32 -0500

> organization that operates the network, but is willing to conform with

That would be covered by "or expected to conform with the policies of
the organization that owns and operates the network."