Subject: RE: Modefg considered harmful

From: "Darren Dukes" <[email-masked]>
Date: Mon, 3 Feb 2003 00:09:30 -0500

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Scott G. Kelly
> Sent: Friday, January 31, 2003 5:21 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: Modefg considered harmful
>
>
> Hi Darren,
>
> Darren Dukes wrote:
> >
> > I think any mature implementations that will be trying to use DHCP for
> > complete configuration of the ipsec client (beyond network
> addresses, as is
> > possible with modecfg today) will need to implement their own
> DHCP client
> > and server in order to include their user-specific ipsec-VPN
> configuration.
> > So what we'll end up with is as follows.
> >
> > OS-DHCP-client(optional) <-> ipsec-DHCP-client <TUNNEL> SGW-DHCP-server
> >
> > Reusing the OS DHCP client (if possible at all) will not give enough
> > flexibility.
>
> What ipsec-vpn configuration are you referring to? DHCP permits
> configuration of (at least) the following:
>
>       o IP address(es)
>       o Subnet mask(s)
>       o Broadcast address(es)
>       o Host name
>       o Domain name
>       o Time offset
>       o Servers (e.g., SMTP, POP, WWW, DNS/NIS, LPR,
>         syslog, WINS, NTP, etc. )
>       o Router(s)
>       o Router discovery options
>       o Static routes
>       o MTU
>       o Default TTL
>       o Source routing options
>       o IP Forwarding enable/disable
>       o PMTU options
>       o ARP cache timeout
>       o X Windows options
>       o NIS options
>       o NetBIOS options
>       o Vendor-specific options
>
> DHCP is obvlivious to the presence of the VPN, and as far as I can tell,
> it has never been the intent of either the ipsec or ipsra wg's to
> provide vpn policy config, so I can't figure out what you might be
> talking about.

Something as basic as per-user or group subnets requiring protection; I have
access to 3.4.5.0/255.255.255.0 but nobody else does.  I can not see how
this sort of thing could be supported by ipsec-DHCP, is it?  Really it comes
down to how extensible the tunnelled ipsec-DHCP is for IRACS.  If there can
be no per-user or group configuration of the IRAC then the people deploying
IKEv2 VPNs will see a big step backward from their IKEv1/modecfg deployments
today.

Darren

> Scott

---

From: "Scott G. Kelly" <[email-masked]>
Date: Mon, 03 Feb 2003 09:50:35 -0800

Hi Darren,

Darren Dukes wrote:
<trimmed...>
> IKEv2 VPNs will see a big step backward from their IKEv1/modecfg deployments

If I'm not misunderstanding you, it sounds like you want to configure
IRAC policy - is this correct? If so, this was strictly off-limits to us
in IPSRA, and was said to be in the domain of the IPSP wg, and so it was
not considered in the ipsra requirements rfc. If you don't intend to use
this to configure policy, please give an example of how you would use
this.

Thanks,

Scott