Subject: Re: When to use AH-within-MEGACO

From: Brian Rosen <[email-masked]>
Date: Mon, 16 Aug 1999 09:23:24 -0400

Security is mandatory to implement, optional to use.
The question is do we require all MGCs to implement AH-under-
Megaco even if it can implement IPSEC in order to interoperate
with any MG that does not have IPSEC, or do we allow it
to be optional-to-implement if IPSEC is implemented.

Brian

> -----Original Message-----
> From: Natarajan Kalpathy [mailto:[email-masked]]
> Sent: Friday, August 13, 1999 3:35 PM
> To: [email-masked]
> Subject: Re: When to use AH-within-MEGACO
>
>
> Well  first  of  all  secutrity  is  a   optional  item  if
> you   look  at
> ABNF  grammer , i dont  know  why  is  it  complusory for MGC
>  to  implement
> MGC . The current  draft clearly states that if   some  one
> have  IPSEC
> implemented  then  it  is  the  first  choice  other wise
> one  can  go  for
> MEGACO  AH  header  if  he  wants  security
>
> Natarajan
>
>
>
>
> Brian Rosen <[email-masked]> on 08/13/99 02:03:27 PM
>
> Please respond to Brian Rosen <[email-masked]>
>
> Sent by:  Brian Rosen <[email-masked]>
>
>
> To:   [email-masked]
> cc:    (Natarajan Kalpathy/MW/US/3Com)
> Subject:  When to use AH-within-MEGACO
>
>
>
>
> The Berlin draft changed the wording for AH-under-MEGACO to
> read:
>
> Implementations MUST implement IPsec AH header if the underlying
> operating systems supports it; if the operating systems support
> IPsec AH-headers, the AH-within-MEGACO/H.248 MUST NOT be
> used.Implementations may support the ESP header.  IPSEC and AH-
> within-MEGACO/H.248 must not be used at the same time.
>
> Other than the obvious editing typos,
> I don't think this captures what we want to do.
>
> I believe we can assert that MGCs must implement IPSEC.  If
> anyone objects, please yell now.  I then propose that the
> words say, if an MG can do IPSEC, that is what it must do.
> If you can't then MGs must implement AH-in-MEGACO.
> MGCs must implement both.
>
> Brian
>

---

From: Matt Holdrege <[email-masked]>
Date: Mon, 16 Aug 1999 08:20:22 -0700

We aren't the protocol police. All you can do is spell it out that some
MG's may have the alternate AH scheme and some may have true IPsec. MGC's
should have both IPsec and the alternate scheme or they risk
non-interoperability.

---

From: Bob Bell <[email-masked]>
Date: Mon, 16 Aug 1999 10:50:05 -0600

I am a little confused. IPSec defines both the use of the AH for
authentication and an Encapsulating Security Payload for opaque tunnelling
of the IP Stream. IPSec may be used for the MEGACO signalling packages, but
there are serious questions about its use on the RTP stream.
Bob Bell

>> > MGCs must implement both.

Bob Bell
Cisco Systems Inc.
801-294-3034(v)
801-294-3023(f)