Subject: When to use AH-within-MEGACO

From: Brian Rosen <[email-masked]>
Date: Fri, 13 Aug 1999 15:03:27 -0400

The Berlin draft changed the wording for AH-under-MEGACO to
read:

Implementations MUST implement IPsec AH header if the underlying
operating systems supports it; if the operating systems support
IPsec AH-headers, the AH-within-MEGACO/H.248 MUST NOT be
used.Implementations may support the ESP header.  IPSEC and AH-
within-MEGACO/H.248 must not be used at the same time.

Other than the obvious editing typos,
I don't think this captures what we want to do.

I believe we can assert that MGCs must implement IPSEC.  If
anyone objects, please yell now.  I then propose that the
words say, if an MG can do IPSEC, that is what it must do.
If you can't then MGs must implement AH-in-MEGACO.
MGCs must implement both.

Brian

---

From: Shyamal Prasad <[email-masked]>
Date: Fri, 13 Aug 1999 15:08:13 -0500

"Brian" == Brian Rosen <[email-masked]> writes:

    Brian> I believe we can assert that MGCs must implement IPSEC.  If
    Brian> anyone objects, please yell now.

NOOOOO!! :-)

You are assuming that MGC's will be built on "well known" operating
systems. You explained in Oslo how many real time operating systems
will not have IP Sec for a while, and why IP Sec could not be mandated
for that reason.

I can assure you that MGC's will be built on such platforms. There is
absolutely no pressing reason to build MGC's on Solaris/Wintel
boxes. Please think very carefully about why you can assume otherwise
(there are 25 Mhz embedded systems, and then there are 400 Mhz
superscalar cards that also run such systems).

Cheers!
Shyamal

---

From: Christer Holmberg <[email-masked]>
Date: Wed, 18 Aug 1999 17:29:35 +0300

Hi,

I don't think IPsec has anything to do with H.248, or any other
same-layer protocol. IPsec is a method for encryption IP packets -
period - no matter what is on the layers above. If IPsec is mandatory
for H.248, is MUST be implemented on all the different MGC/MG platforms.
Ok, today it probably isn't, and that IS a big problem, but I still
don't think adding IPsec stuff, like AH and/or ESP, in the protocol is
the right answer.

Consider this case:

Example 1: If the MGC platform supports IPsec, it will change the
next-protocol field in the IP header to the one used by AH or ESP
(sorry, I don't remember the values by hand). Then, if the MG platform
does not support IPsec (it will be taken care of by the H.248 protocol),
where will the IP stack forward the packet? It does not see it as a
TCP/UDP/whatever-transport-H.248-will-use packet, but as IPsec packet,
and since IPsec is not implemented on the platform, there is no place to
send the packet.

Example 2: If the MG platform does not support IPsec, the protocol will
add the AH header, but will not be able to change the next-protocol
field in the IP header. Thus, the MGC platform, that DOES support IPsec,
will not see it as an IPsec packet, but as a normal
TCP/UDP/whatever-transport-H.248-will-use packet. H.248 will then get a
packet with an AH header, which it has to deal with itself, which means
there is no use to have IPsec on the platform itself in the first place.

The second example is probably easier to deal with than the first, but I
still think it makes things quite complicated.

Maybe I've missed something, so please correct me if I'm wrong.

Christer