Subject: [VRRP] Please clear draft-ietf-vrrp-unified-spec number 2

From: Stephen Nadas <[email-masked]>
Date: Fri, 2 Oct 2009 08:18:24 -0400

Hi Jari,

Regarding this discuss, will the below clear it (I hope so as it's based on your suggestion :-)

Thanks,
Steve

Discuss:

Thirdly, I do not understand why there is no issue, because the
backup taking over, because then the backup has to authoratively
sign the NAs and RAs it is sending, for the primary's address.
If the "trust anchor and cga" mode from RFC 3971 is used, the
private key would have to be shared, or this would not work at
all. And private key sharing is not necessarily a good idea.

I would recommend saying this:
- VRRP is compatible with "trust anchor" and "trust anchor or cga" modes
  of SEND
- The configuration needs to give the two routers the same
  prefix delegation in the certificates
- But still, the routers should have their own key pairs

Text added at end of section 9:

   In the context of IPv6 operation, if SEcure Neighbor Discovery (SEND)
   is deployed, VRRP is s compatible with the "trust anchor" and "trust
   anchor or cga" modes of SEND [RFC3971].  The (SEND) configuration
   needs to give the master and backup routers the same prefix
   delegation in the certificates so that master and backup routers
   advertize the same set of subnet prefixes.  However, the master and
   backup routers should have their own key pairs to avoid private key
   sharing.

---

From: Jari Arkko <[email-masked]>
Date: Fri, 02 Oct 2009 20:19:19 +0300

Ok for me (and same for your other mails). So this is just your text 
suggestion or do you actually have a new draft version out there? I 
don't find a new draft version yet...

Jari

---

From: Stephen Nadas <[email-masked]>
Date: Fri, 2 Oct 2009 13:36:03 -0400

It is text suggestion until I get it all lined up 
Thanks
Steve  

SJN> -----Original Message-----
SJN> From: Jari Arkko [mailto:[email-masked]] 
SJN> Sent: Friday, October 02, 2009 1:19 PM
SJN> To: Stephen Nadas
SJN> Cc: Mukesh Gupta; [email-masked]; 
SJN> [email-masked]; [email-masked]
SJN> Subject: Re: Please clear draft-ietf-vrrp-unified-spec number 2
SJN> 
SJN> Ok for me (and same for your other mails). So this is just 
SJN> your text suggestion or do you actually have a new draft 
SJN> version out there? I don't find a new draft version yet...
SJN> 
SJN> Jari
SJN> 
[snipped]