Subject: Re: [IPsec] Proposed work item: IKE/IPsec high availability and load sharing

From: Scott C Moonen <[email-masked]>
Date: Wed, 2 Dec 2009 20:42:38 -0500

If this proposal is accepted, I commit to review it.

Scott Moonen ([email-masked])
z/OS Communications Server TCP/IP Development
http://www.linkedin.com/in/smoonen

From:
Yaron Sheffer <[email-masked]>
To:
"[email-masked]" <[email-masked]>
Date:
11/29/2009 12:41 PM
Subject:
[IPsec] Proposed work item: IKE/IPsec high availability and load sharing

This work item will define the problem statement and requirements for a 
solution that allows interoperable HA/LS device groups. Mixed-vendor 
clusters are specifically out of scope; but single-vendor clusters should 
be fully interoperable with other vendors’ devices or clusters. The main 
challenge is to overcome the strict use of sequence numbers in both IPsec 
and IKE, in HA and LS scenarios. Following the Hiroshima discussion, the 
WI is initially focused on defining the problem, rather than a particular 
solution.
 
Proposed starting point: 
http://tools.ietf.org/id/draft-nir-ipsecme-ipsecha-00.txt.
 
Please reply to the list:
 
- If this proposal is accepted as a WG work item, are you committing to 
review multiple versions of the draft?
- Are you willing to contribute text to the draft?
- Would you like to co-author it?
 
Please also reply to the list if:
 
- You believe this is NOT a reasonable activity for the WG to spend time 
on.
 
If this is the case, please explain your position. Do not explore the fine 
technical details (which will change anyway, once the WG gets hold of the 
draft); instead explain why this is uninteresting for the WG or for the 
industry at large. Also, please mark the title clearly (e.g. "DES40-export 
in IPsec - NO!")._______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Michael Richardson <[email-masked]>
Date: Thu, 03 Dec 2009 22:17:48 -0500

Yaron Sheffer wrote:
> clusters are specifically out of scope; but single-vendor clusters 
> should be fully interoperable with other vendors’ devices or clusters. 
> The main challenge is to overcome the strict use of sequence numbers in 
> both IPsec and IKE, in HA and LS scenarios. Following the Hiroshima 
> discussion, the WI is initially focused on defining the problem, rather 
> than a particular solution.
> 
>  
> 
> Proposed starting point: 

It is interesting work, and may well be valuable.
It is not a priority to me, and I would not have time to work on it.
I might read a WG FC, and I might respond to threads, if I came across
them.

---

From: Daniel Migault <[email-masked]>
Date: Mon, 7 Dec 2009 16:31:39 +0100

I will also review this document.
Regards,
Daniel

On Fri, Dec 4, 2009 at 4:17 AM, Michael Richardson <[email-masked]> wrote:

>> clusters are specifically out of scope; but single-vendor clusters should be
>> fully interoperable with other vendors’ devices or clusters. The main
>> and IKE, in HA and LS scenarios. Following the Hiroshima discussion, the WI
>> is initially focused on defining the problem, rather than a particular
>> solution.
>>
>>
>> Proposed starting point:
> _______________________________________________
> IPsec mailing list
> [email-masked]

-- 
Daniel Migault
Orange Labs -- Security
+33 6 70 72 69 58

---

From: Jean-Michel Combes <[email-masked]>
Date: Mon, 7 Dec 2009 19:40:19 +0100

Hi,

After a discussion on the scope of this draft, I decided to change my
opinion regarding what I said during the IETF meeting: now, I am ready
to review the draft but no more to contribute to it.

Best regards.

JMC.

2009/11/29 Yaron Sheffer <[email-masked]>:
> - You believe this is NOT a reasonable activity for the WG to spend time on.
>
>
>
> in IPsec - NO!").

---

From: "V Jyothi-B22245" <[email-masked]>
Date: Tue, 8 Dec 2009 11:17:20 +0530

Hi,

I am willing to review multiple versions of the draft, contribute text
and co-author it.

Thanks
Jyothi

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of Jean-Michel Combes
Sent: Tuesday, December 08, 2009 12:10 AM
To: Yaron Sheffer
Cc: [email-masked]
Subject: Re: [IPsec] Proposed work item: IKE/IPsec high availability
andload sharing

Hi,

Best regards.

JMC.

2009/11/29 Yaron Sheffer <[email-masked]>:
> This work item will define the problem statement and requirements for 
> a solution that allows interoperable HA/LS device groups. Mixed-vendor

> should be fully interoperable with other vendors' devices or clusters.

> The main challenge is to overcome the strict use of sequence numbers 
> in both IPsec and IKE, in HA and LS scenarios. Following the Hiroshima

> discussion, the WI is initially focused on defining the problem, 
> rather than a particular solution.
>
>
>
> Proposed starting point:
> - If this proposal is accepted as a WG work item, are you committing 
> to review multiple versions of the draft?
>
> If this is the case, please explain your position. Do not explore the 
> fine technical details (which will change anyway, once the WG gets 
> hold of the draft); instead explain why this is uninteresting for the 
> WG or for the industry at large. Also, please mark the title clearly 
> (e.g. "DES40-export in IPsec - NO!").
>

---

From: "Murthy N Srinivas-B22237" <[email-masked]>
Date: Tue, 8 Dec 2009 23:09:58 +0530

I would like to coauthor IKE/IPsec high availability and load sharing.
Looks like a challenging and intereting problem.

Thanks
-ns murthy

________________________________

From: [email-masked] [mailto:[email-masked]] On Behalf
Of Daniel Migault
Sent: Monday, December 07, 2009 9:02 PM
To: Michael Richardson
Cc: [email-masked]
Subject: Re: [IPsec] Proposed work item: IKE/IPsec high availability
andload sharing

On Fri, Dec 4, 2009 at 4:17 AM, Michael Richardson <[email-masked]>
wrote:

	Yaron Sheffer wrote:

		This work item will define the problem statement and
requirements for a solution that allows interoperable HA/LS device
groups. Mixed-vendor clusters are specifically out of scope; but
single-vendor clusters should be fully interoperable with other vendors'
devices or clusters. The main challenge is to overcome the strict use of
sequence numbers in both IPsec and IKE, in HA and LS scenarios.
Following the Hiroshima discussion, the WI is initially focused on
defining the problem, rather than a particular solution.

		Proposed starting point:

	It is interesting work, and may well be valuable.
	It is not a priority to me, and I would not have time to work on
it.
	I might read a WG FC, and I might respond to threads, if I came
across
	them. 

-- 
Daniel Migault
Orange Labs -- Security
+33 6 70 72 69 58