Subject: [IPsec] ICSA Labs IKEv2 Bakeoff IV

From: "Snyder, Guy" <[email-masked]>
Date: Tue, 4 Dec 2007 17:01:19 -0500

Attendees from the last bakeoff and our IPSec Consortium have shown
interest in ICSA Labs conducting another bakeoff in 2008.  I am sending
this notice to this list to ensure that others in the IPsec community
are aware of the plans for another IKEv2 Interoperability Workshop.  At
the last bakeoff I promised to solicit interest in a bakeoff for 2008.
Plans currently are targeting the April/May 2008 timeframe.  This
timeframe is from feedback from our IPSec Consortium and attendees from
the last bakeoff.  Can you provide feedback to me as to your interest
level, preferred timeframe, testing content and preferred location?  I
expect the location to be centrally located in the US based on current
feedback.

We also discussed different testing options such as normal (same as in
the past with slightly different test suites), IPv6 only, MOBIKE, and
carrier/mobile specific.  Oddly enough, after conducting three previous
bakeoffs there are still requests to include "basic" IKEv2 tests.
Please provide your feedback on these testing options also.

-- Guy Snyder, VPN Programs Manager

-- ICSA Labs

_______________________________________________
IPsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Thu, 6 Dec 2007 12:35:40 +0200

I don't think the requests for "basic" IKEv2 tests are so odd.  In the  
last bakeoff there were still problems getting the basic stuff to  
work. We had IKE sessions torn down because one peer did not  
understand the NAT-D payloads, to name but one example.

OTOH doing bakeoff after bakeoff with the same tests does mean that we  
get very little new relevant information.  I think we've moved beyond  
conflicting interpretations of the RFC text, and the problems we see  
now are simply bugs. That could be caused by the fact that most  
vendors still don't have IKEv2-enabled products on the market, so what  
we see in the bakeoffs are lab projects.  I don't know if this will  
change significantly by May.

What I would like to see is a greater focus on the remote access case,  
where products are either "clients" or "gateways" (I know these are  
not IPsec terms, but they're so useful), and they should be able to  
connect in difficult situations - behind NAT devices, for example, and  
should work with EAP servers (RADIUS) as well as PSK and certificates.

On Dec 5, 2007, at 12:01 AM, Snyder, Guy wrote:

> interest in ICSA Labs conducting another bakeoff in 2008.  I am  
> sending this notice to this list to ensure that others in the IPsec  
> community are aware of the plans for another IKEv2 Interoperability  
> Workshop.  At the last bakeoff I promised to solicit interest in a  
> bakeoff for 2008.  Plans currently are targeting the April/May 2008  
> timeframe.  This timeframe is from feedback from our IPSec  
> Consortium and attendees from the last bakeoff.  Can you provide  
> feedback to me as to your interest level, preferred timeframe,  
> testing content and preferred location?  I expect the location to be  
> centrally located in theUS based on current feedback.
>
> We also discussed different testing options such as normal (same as  
> in the past with slightly different test suites), IPv6 only, MOBIKE,  
> and carrier/mobile specific.  Oddly enough, after conducting three  
> previous bakeoffs there are still requests to include “basic” IKEv2  
> tests.  Please provide your feedback on these testing options also.
>
> Scanned by Check Point Total Security Gateway.
>