Subject: Re: [Ipsec] 'Name' as Selector

From: Stephen Kent <[email-masked]>
Date: Mon, 3 Jan 2005 11:11:26 -0500

At 10:16 PM -0800 12/30/04, Surya Batchu wrote:
>Section 4.4.1.1 of rfc2401-bis describes 'Name' in
>selectors and its usage of it.
>
>Based on my understanding after reading this section,
>this is mainly intended to be used in  remote access
>scenarios.
>What is the advantage of using this over IRAC/IRAS
>method
>specified by IKEv2 draft? Aren't both addressing and
>solving the same problem? If so, why is the support
>for
>'Names' is made MUST? If not, can somebody describe
>the usage scenaris of 'Name' field in SPD policy?
>
>Thanks
>Surya

IRAC/IRAS deals with the ability of a remote client to be assigned a 
(local) address when it established a tunnel to a security gateway. 
It does not address the question of how to authenticate the remote 
client and make an IPsec access control decision prior to this 
address assignment phase of IKE.  Thus I believe that the Name form 
of identity is still appropriate and in text I prepared for the 
pki4ipsec WG, I explained in  ore detail how/when to use this form of 
ID in the initial IKE peer authentication and authorization phase.

Steve

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec