Subject: [IPsec] Potential way forward for IPsecME on ESP-NULL

From: Paul Hoffman <[email-masked]>
Date: Tue, 17 Feb 2009 06:56:05 -0800

Wearing our one-size-fits-all shared co-chair hat, Yaron and I propose the following.

- Both documents can continue forwards, adding the heuristics document as a WG item. Pasi has agreed that the current WG charter allows this.

- The heuristics document would eventually be published as an Informational RFC. WESP would be the protocol produced by the WG.

- The purpose of the heuristics document would be to help deep-inspection firewall vendors find ESP-NULL traffic that is not encapsulated with WESP. It is considered an educational document for firewall developers who might want to do heuristic checks on ESP traffic. Firewalls might want to do this until WESP is widely deployed, or even after wide deployment if sufficient firewall resources are available in order to check for ESP-NULL that is not yet wrapped in WESP.

- Each document talks about the applicability of its own content, while referring to the other document.

Are there any strong objections to this plan?

--Paul Hoffman, Director
--VPN Consortium

---

From: "Dragan Grebovich" <[email-masked]>
Date: Wed, 18 Feb 2009 08:01:09 -0500

Sounds good to me.  That's all I wanted from Day One.  :-)

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of Paul Hoffman
Sent: Tuesday, February 17, 2009 9:56 AM
To: IPsecme WG
Subject: [IPsec] Potential way forward for IPsecME on ESP-NULL

Wearing our one-size-fits-all shared co-chair hat, Yaron and I propose
the following.

- Both documents can continue forwards, adding the heuristics document
as a WG item. Pasi has agreed that the current WG charter allows this.

- The heuristics document would eventually be published as an
Informational RFC. WESP would be the protocol produced by the WG.

- The purpose of the heuristics document would be to help
deep-inspection firewall vendors find ESP-NULL traffic that is not
encapsulated with WESP. It is considered an educational document for
firewall developers who might want to do heuristic checks on ESP
traffic. Firewalls might want to do this until WESP is widely deployed,
or even after wide deployment if sufficient firewall resources are
available in order to check for ESP-NULL that is not yet wrapped in
WESP.

- Each document talks about the applicability of its own content, while
referring to the other document.

--Paul Hoffman, Director
--VPN Consortium
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: "Grewal, Ken" <[email-masked]>
Date: Wed, 18 Feb 2009 09:05:48 -0700

Hi Paul, 
I have no objections to this approach moving forward. 

Thanks, 
- Ken

>From: [email-masked] [mailto:[email-masked]] On Behalf Of
>Paul Hoffman
>Sent: Tuesday, February 17, 2009 6:56 AM
>To: IPsecme WG
>- Both documents can continue forwards, adding the heuristics document as a
>WG item. Pasi has agreed that the current WG charter allows this.
>
>- The heuristics document would eventually be published as an Informational
>RFC. WESP would be the protocol produced by the WG.
>
>- The purpose of the heuristics document would be to help deep-inspection
>firewall vendors find ESP-NULL traffic that is not encapsulated with WESP.
>It is considered an educational document for firewall developers who might
>want to do heuristic checks on ESP traffic. Firewalls might want to do this
>until WESP is widely deployed, or even after wide deployment if sufficient
>firewall resources are available in order to check for ESP-NULL that is not
>yet wrapped in WESP.
>