Subject: RE: [RPSEC] Re: no TCP-MD5 replacement please

From: "Bora Akyol" <[email-masked]>
Date: Fri, 27 Jan 2006 12:07:59 -0800

Can you please qualify "easily"?

Just like the TCP-MD5, the distribution of keys, management,
synchronized rollover etc, become similar issues with IPSEC, no?

Regards,

Bora

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of David Ward
> Sent: Monday, January 23, 2006 1:29 PM
> To: Stephen Kent; Pekka Savola; David Ward
> Cc: [email-masked]
> Subject: Re: [RPSEC] Re: no TCP-MD5 replacement please
> 
> All -
> 
> In the past I wrote a draft on how to run BGP w/ IPsec. There 
> are effectively no protocol changes required. If we want it 
> dusted off and republished, I can revisit it. Note that there 
> is no magical golden ring that one obtains by running BGP 
> over IPsec but, it can easily be done and written as a BCP, 
> informational ...
> 
> -DWard

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: David Ward <[email-masked]>
Date: Fri, 27 Jan 2006 14:31:44 -0600

"Easily" means that there are no BGP or IPsec changes necessary. As we know,
IPsec is designed to allow apps to be able to run w/o change over a tunnel
or in transport mode. In this regard, BGP is just another application.

Wrt the operational needs of IPsec and key mgmt ... it already is specified
and there is wide implementation of sync rollover, management, distribution,
etc. 

0.02$

-DWard

---

From: Jeroen Massar <[email-masked]>
Date: Fri, 27 Jan 2006 21:30:57 +0100

> synchronized rollover etc, become similar issues with IPSEC, no?

You mean to say that you still type every line of the configuration file
in your router!? :) Indeed it gives some pains but a management utility
for your router will take most of those away.

Having an extra line for the configuration statements that IPSEC brings
is not much different from having the management utility generate that
line you needed to generate for the TCP-MD5 option...

Next to the IPSEC option, (maybe I missed out on this one) is the option
for checking the TTL, thus that it is still 255 already done? That would
also already save quite some trouble, at least it limits hijacking/rst's
etc, if they are possible, to the same subnet when spoofed packets could
be directed to the RE.

Greets,
 Jeroen