Subject: [Pana] Issue 215 (AD-review, pana-fwk, section 10.2.2.1, Case C)

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 01 Nov 2005 15:01:16 -0500

(CC'ing to security ADs as the issue contains a question for the ADs.

Regarding http://danforsberg.info:8080/pana-issues/issue215:

>   Case C: IPsec-TIA obtained by using RFC3456
>
>
Please don't use RFC numbers as nouns or title describing something, use
them only as references which may be easily updated in the future.

  Ohba: We will change the title to: "Case C: IPsec-TIA obtained by
  using DHCPv4 Configuration of IPsec Tunnel Mode"

>      Like Case B, the PRPA is obtained by using DHCPv4.  The difference
>      is that the POPA (eventually used as IPsec-TIA) and other
>      configuration parameter are configured by running DHCPv4 over a
>      special IPsec tunnel mode SA [RFC3456].  Note that the PRPA DHCPv4
>      Server and IPsec-TIA DHCPv4 Server may be co-located on the same
>      node.
>
Is it *helpful* if they are co-located? Do they *need* to be co-located?

  Ohba: They don't need to be co-located, but it would be simpler if
  they are co-located.

>      Note: this case may be used only when IKEv1 is used as the IPsec
>      key management protocol (IKEv2 does not seem to support RFC3456
>      equivalent case).
>
>
Reference for IKEv2? 

  Ohba: We will a add reference for IKEv2.  

This is a good question for the Sec ADs as well, is
there a plan to update RFC3456 for IKEv2?

  Ohba: Security ADs may answer to this question.
  
Just a question: Is it not more common for extensions to IKE to
communicate the IP address rather than running DHCP?

  Ohba: An IPsec expert may answer to this question.

Regards,
Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana