Subject: Re: [IPsec] Redirect draft and REDIRECT_ACK notify

From: Paul Hoffman <[email-masked]>
Date: Tue, 13 Jan 2009 09:34:15 -0800

Yaron (without his co-chair hat on) has an opinion, and so does Tero; these two opinions are quite different technically. However, we are not hearing enough opinions on the list. I don't really care whether Yaron's opinion or Tero's gets WG consensus, but I do care if there is so little interest in this that they are not reading what is likely to be the first RFC out of this WG.

The two choices so far are to include a NOTIFY in the response or to use a separate Informational exchange. I think there is agreement that they would both have the same semantics, but they are done quite differenty.

If you have an opinion, please comment on the thread and state why you prefer a NOTIFY or a separate exchange. If you have thought about it and you truly don't care, please say that as well.

--Paul Hoffman, Director
--VPN Consortium
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Tue, 13 Jan 2009 22:25:45 +0200

On Jan 13, 2009, at 7:34 PM, Paul Hoffman wrote:

> Yaron (without his co-chair hat on) has an opinion, and so does  
> Tero; these two opinions are quite different technically. However,  
> we are not hearing enough opinions on the list. I don't really care  
> whether Yaron's opinion or Tero's gets WG consensus, but I do care  
> if there is so little interest in this that they are not reading  
> what is likely to be the first RFC out of this WG.
>
> The two choices so far are to include a NOTIFY in the response or to  
> use a separate Informational exchange. I think there is agreement  
> that they would both have the same semantics, but they are done  
> quite differenty.
>
> If you have an opinion, please comment on the thread and state why  
> you prefer a NOTIFY or a separate exchange. If you have thought  
> about it and you truly don't care, please say that as well.
>
> --Paul Hoffman, Director
> --VPN Consortium

I think that we don't need a REDIRECT_ACK, since the client cannot  
reject the REDIRECT. However, a DELETE should not be implied. If the  
gateway would also like to delete, it should send an explicit DELETE.   
It's also possible for the gateway to not send a DELETE, and simply go  
down and trust liveness checks to inform the client, but rejecting  
valid IPsec traffic due to invalid SA should be wrong.

Email secured by Check Point
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Joy Latten <[email-masked]>
Date: Fri, 16 Jan 2009 17:52:55 -0600

> valid IPsec traffic due to invalid SA should be wrong.
I've read the draft but am just reading this thread. I agree with this. 
It also made sense to me when someone mentioned the server including the
DELETE with the REDIRECT to avoid possibility of server not getting a
chance to send the DELETE. 

regards,
Joy Latten