Subject: v6ops-nat64-pb-statement-req: IPsec requirement

From: Thomas Narten <[email-masked]>
Date: Tue, 22 Jul 2008 17:22:42 -0400

draft-ietf-v6ops-nat64-pb-statement-req-00.txt says:

>    R11: IPsec support.
> 
>    The translator MUST support communication between IPv4 node and IPv6
>    node using UDP Encapsulation of IPsec ESP Packets as defined in
>    [RFC3948] as applicable.  RFC3948 should be interpreted as with the
>    IPv6 side on the IPv6-IPv4 translator being the IPv4 private side of
>    the conventional NAT.  IPsec support MAY require updating also the
>    IPv4 side.

Actually, I think the real requirement is that both IPsec and IKEv2
work. IPsec without key management is pretty useless in practice. Is
that what is meant?

Thomas

---

From: marcelo bagnulo braun <[email-masked]>
Date: Wed, 23 Jul 2008 16:06:46 +0200

> work. IPsec without key management is pretty useless in practice. Is

i think so, i have changed that to

   node using UDP Encapsulation of IKE and IPsec ESP Packets as defined in

would that be better?

---

From: Thomas Narten <[email-masked]>
Date: Wed, 23 Jul 2008 16:17:29 -0400

> would that be better?

Yes, but...

Question: Why was UDP encapsulation chosen? Should we even have that
requirement at this point? Seems to me that the requirement should be
more like:

   The translator MUST be able to support the translation of at least
   one mode of IPsec and IKE flows sufficient to allow nodes using IKE
   and IPsec to successfully set up and use IPsec SAs.  Although
   desirable, it is not a requirement that such a capability be done
   with no changes to the IPv4 node's IKE/IPsec implementation.

Thoughts?

Thomas

---

From: marcelo bagnulo braun <[email-masked]>
Date: Thu, 24 Jul 2008 09:42:33 +0200

Thomas Narten escribió:
> requirement at this point? 

more background
the point made in the previous meeting was that this must provide at 
least the same functionality than current v4 nats, and that is what nats 
currently support as defined in rfc3948, hence the wording, but i 
certainly agree that what you write below is what we want to say, so i 
will change this to your  wording in the document if nobody opposes

one more question, people have asked me explicitly to have the reference 
to 3948, do you think we should keep that somehow is we can drop it?
> Seems to me that the requirement should be
> more like:
>