Subject: [bmwg] updated ipsec docs

From: Merike Kaeo <[email-masked]>
Date: Fri, 3 Apr 2009 11:36:42 -0700

The new version of the ipsec terminology (draft-ietf-bmwg-ipsec- 
term-11.txt) and ipsec methodology (draft-ietf-bmwg-ipsec- 
meth-04.txt) documents were posted today.

The following modifications were done from the previous versions and  
address all the comments made in the last year.

additions/changes for term-11 draft:
- change definition of IPsec Server to IPsec Gateway and in the issue  
section state
    "IPsec Gateways are also sometimes referred to as 'IPsec Servers'  
or 'VPN
    Concentrators'
- added NAT traversal to security context under IKE context as a MUST
- changed 'IPsec Tunnel Capacity' to explicitly state that each IPsec SA
   is associated with exactly 1 IKE SA
- IPsec througput definition - delete second paragraph in discussion
- Changed Phase 1 DoS resiliency rate definition to generalize on a  
rate of
   measurement that is to be measured as a graph of valid IKE Phase 1  
tunnel
   attempts per second (TAPS) and the percentage of failure

additions/changes for meth-04 draft:
- added text under 'Frame Type' section to explicitly recommend  
testing Nat-Traversal scenario which requires UDP encapsulation.
- changed text 'Testing of AH Transforms 1 and 2 MUST be supported'  
to 'If AH is supported by the DUT/SUT testing of AH Transforms 1 and  
2 MUST be supported'
- added clarification text to section 9.1 on throughput baseline and  
reference to IPsec SA traffic selectors
- modified section 9.1 language on reporting format to get rid of  
terms 'advertising copy' and 'product datasheet' and any references  
to publications requirements
- modified text in all frame loss test procedures to mention 'nominal  
device throughput' rather than 'frame rate on input media
- add text for 11.2 topology section to address scenario with an  
asymmetric topology
- added single tunnel, maximum throughput case in section 14 as a MUST
- modified text in 15.1 to change test procedure so that it would  
quantify the measure
- modified text in 15.2 to make scalability point explicit and  
clarify reporting format text
- added text in sections 12.1, 12.2 and 15.1 to address the case  
where you can have less than n IKE Phase 1 policies configured to  
still have offered traffic create n IKE SAs

Thanks to Yaron Sheffer for his help on the xml conversions which I  
now finally have a hang of.

- merike

---

From: Al Morton <[email-masked]>
Date: Fri, 03 Apr 2009 14:40:36 -0400

Many thanks for your persistence and efforts, Merike!

Thanks to Yaron, too, for his insightful comments.

Al
bmwg chair

---

From: Al Morton <[email-masked]>
Date: Sun, 05 Apr 2009 17:26:36 -0400

BMWG,

This message begins a Last call on the IPsec terms and methods.

There little I can add to Merike's summary below, except a
few URLs and a date:

http://tools.ietf.org/wg/bmwg/draft-ietf-bmwg-ipsec-term/
http://tools.ietf.org/wg/bmwg/draft-ietf-bmwg-ipsec-meth/

The Last Call with end on April 20, 2009.

Please weigh-in on whether or not these Internet-Drafts
should be given to the Area Directors and IESG for consideration and
publication as an Informational RFCs.  Send your comments
to this list or [email-masked].

Al
bmwg chair

At 02:36 PM 4/3/2009, Merike Kaeo wrote:
>The new version of the ipsec terminology 
>(draft-ietf-bmwg-ipsec-term-11.txt) and ipsec methodology 
>(draft-ietf-bmwg-ipsec-meth-04.txt) documents were posted today.
>