Subject: Re: [AAA-WG]: transport MUSTs

From: David Frascone <[email-masked]>
Date: Sun, 20 May 2001 21:01:19 -0500

On Sun, May 20, 2001 at 05:36:12PM -0700, David Spence wrote:
> 
> In addition to these reasons, I believe we discussed the problem that an
> SCTP-compliant server may, for a while yet, be run on a non-SCTP-compliant
> host operating system and therefore it may not be possible to reach the
> server via SCTP.
> 
> So I think that we still need to require that clients MUST support TCP.

But, wasn't this just so NAS's did not have to support SCTP?  I read the 
minutes as, "If possible, NAS's should support SCTP.  If they can not, then
they MUST support TCP."

-Dave

---

From: David Spence <[email-masked]>
Date: Sun, 20 May 2001 23:57:45 -0700

> minutes as, "If possible, NAS's should support SCTP.  If they can not, then

That's not what the minutes say to me.  I repeat the quote from the minutes:

   9. AAA Servers MUST support TCP & SCTP. NASes MUST support TCP,
   MAY support SCTP. The specification will state that "SCTP
   MAY be required in the future."   TCP is required on NASes
   because not all NASes have SCTP in their protocol stacks, because
   SCTP has problems getting past firewalls, and because neither
   TLS nor IPSEC is fully defined for SCTP.

They say that "NASes MUST support TCP".  Then it says that they "MAY support
SCTP".  Then it explains why, noting firewall problems and the further
problems that the required security protocols have not been defined for SCTP
yet.

-- 
David Spence                            email: [email-masked]
Interlink Networks, Inc.                phone: (734) 821-1203
775 Technology Drive, Suite 200         fax:   (734) 821-1235
Ann Arbor, MI 48108           
U.S.A.

---

From: Jari Arkko <[email-masked]>
Date: Mon, 21 May 2001 10:44:21 +0300

> problems that the required security protocols have not been defined for SCTP
I'm still in favor of allowing SCTP-only clients. I don't
think the security is an issue - if the implementation can fulfill
the security and the transport MUSTs, then fine. In any case the
IPsec issue is an optimization issue, not a fundamental problem.
Regarding firewalls, I don't treat that as a practical issue and in
any case that is changing fast at least when I talk to some firewall
vendors.

Yes, I know there are obstacles. But on the other hand I wouldn't
like to drag on old functionality which in practise may not even
fulfill all the telco-standard failover etc. requirements anyway.

Jari