Subject: Re: [Ipsec] First draft of IKEv2.1

From: Francis Dupont <[email-masked]>
Date: Thu, 02 Feb 2006 15:53:26 +0100

Some comments:
 - I am not very convinced it is a good idea to demoted almost half of
   the SHOULDs...
 - typo in 2.6.1 tp -> to
 - in 2.8 what is the "in-place" rekeying of SAs (it seems it is
   rekey before expiration but the wording is not very clear)
 - in 3.15 there is a good example of a SHOULD I'd like to see kept:

   {{ Demoted the SHOULD }} Extensions via the CP payload should not be
   used for general purpose management.  Its main intent is to provide a
   bootstrap mechanism to exchange information within IPsec from IRAS to
   IRAC.  While it MAY be useful to use such a method to exchange
   information between some Security Gateways (SGW) or small networks,
   existing management protocols such as DHCP [DHCP], RADIUS [RADIUS],
   SNMP, or LDAP [LDAP] should be preferred for enterprise management as
   well as subsequent information exchanges.

   As an IPv6 person I believe the CP stuff will never replace something
   like DHCPv6 over XXX.

Regards

[email-masked]

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 2 Feb 2006 10:11:39 -0800

>  - I am not very convinced it is a good idea to demoted almost half of

Could you be specific about which specific SHOULD changes are not a 
"good idea"? Again, the ones made in this document are to make it 
align with RFC 2119.

>  - typo in 2.6.1 tp -> to

Got it, thanks.

>    rekey before expiration but the wording is not very clear)

That is the same wording as RFC 4306.

>    As an IPv6 person I believe the CP stuff will never replace something

That's fine, but what is the value of making that first sentence a 
2119-level requirement?

--Paul Hoffman, Director
--VPN Consortium