Subject: Re: Modefg considered harmful

From: "Marcus Leech" <[email-masked]>
Date: Wed, 05 Feb 2003 11:21:52 -0500

Bill Sommerfeld wrote:
> 
> "what bernard said".
> 
> I see modecfg as reinventing a square wheel.
>
Me too, but there was this issue of the large installed base of
  MODECFG-like things in existing implementations.  Since I'm not
  an implementor, I'm in the situation where I have to believe that
  moving away from a MODECFG-like thing is a hardship.

*If* it's acceptablet to discount such claimed hardship, then I have to
  agree with Bernards assertion that the IPSRA-style DHCP approach is
  cleaner, more flexible, and in the long-term, less work.

-- 
----------------------------------------------------------------------
Marcus Leech                             Mail:   Dept 8M70, MS 012, FITZ
Advisor                                  Phone: (ESN) 393-9145  +1 613 763 9145
Security Architecture and Planning       Fax:   (ESN) 393-9435  +1 613 763 9435
Nortel Networks                          [email-masked]
-----------------Expressed opinions are my own, not my employer's------

---

From: Bill Sommerfeld <[email-masked]>
Date: Wed, 05 Feb 2003 15:43:47 -0500

>   moving away from a MODECFG-like thing is a hardship.

Except that you probably *already* have a DHCP implementation already!

I believe the correct comparison is the complexity of MODECFG vs the
"DHCP to IPsec glue" code; the latter is likely to be significantly
smaller than the former.

>   cleaner, more flexible, and in the long-term, less work.

indeed.

					- Bill