Subject: [IPsec] P2P VPN - Side Meeting

From: Yoav Nir <[email-masked]>
Date: Mon, 14 Nov 2011 04:09:02 +0200

Hi all

This is to announce a side meeting about peer to peer VPN, as described in our recently published draft: http://tools.ietf.org/html/draft-nir-ipsecme-p2p-00

In the meeting we will discuss the use case of directly connecting two IKE implementations that already have a path of trust between them, for example turning star topologies into meshes. The introduction of strangers (AKA "opportunistic encryption") is explicitly out of scope for this meeting.

Where:           TICC building, room 101-D
When:            Wednesday, 16-Nov, at 20:00 (8:00 PM) local time
Jabber:          xmpp:[email-masked]?join
Streaming audio: http://ietf82streaming.dnsalias.net/ietf/ietf824.m3u

Tentative Agenda:
 - A 20-minute presentation about the draft
 - 3-5 really short presentations about existing proprietary (or not) solutions
 - Open discussion on the problem (which will inevitably get into solutions)
 - Next Steps (this is when we ask the "who will edit/contribute/review")

Note:
the streaming audio may or may not work. They don't switch off the audio after hours, but you won't get support from the NOC team either.
If that fails, we'll try to make do with Skype ( http://portal.campaigncc.org/SkypeConferencing ), but that is at best a best-effort solution.

Yoav

---

From: Frederic Detienne <[email-masked]>
Date: Tue, 15 Nov 2011 11:42:49 +0800

Hi Yoav,

We will be there (following offline with you for the details).

I do not think there is a need to spend 20 minutes on the draft which everyone should have read. There are three vague points in it and 10 min seem largely sufficient.

At this stage several vendors think they have a fair understanding of the requirements and a gap analysis is much more productive and constructive. I have just asked Chris Ulliott to provide his feedback in case audio fails on us. We can factor his reply in the discussions.

We will not send our presentation in advance but we will publish the relevant material after the meeting. The discussion following the presentations is likely to bring additional material to the table.

regards,

	fred

On 14 Nov 2011, at 10:09, Yoav Nir wrote:

> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec
>

---

From: Yoav Nir <[email-masked]>
Date: Tue, 15 Nov 2011 06:05:06 +0200

Hi Frederic

Inline...

> I do not think there is a need to spend 20 minutes on the draft which everyone should have read. There are three vague points in it and 10 min seem largely sufficient.

20 minutes includes time spent on hellos, introductions, asking if everyone has read the draft, jabber scribe, testing the audio, and all other kinds of administrivia. You've been to IETF sessions before, and you know how that goes.

> At this stage several vendors think they have a fair understanding of the requirements and a gap analysis is much more productive and constructive. I have just asked Chris Ulliott to provide his fe…

To me the biggest gap in existing solutions is that they require kludges like GRE tunnels and route-based VPN, and also that they don't cover the provisioning of credentials. GRE tunnels and route-based VPNs I consider a kludge because you are then required to treat VPN tunnels as interfaces. Interfaces are much more resource intensive when compared to simple SAs, and most operating systems are very limited in the number of interfaces that they support.

> We will not send our presentation in advance but we will publish the relevant material after the meeting. The discussion following the presentations is likely to bring additional material to the ta…

Downloadable presentations help people who are following remotely (like Chris) in case the audio does not fail.

---

From: Frederic Detienne <[email-masked]>
Date: Tue, 15 Nov 2011 12:12:49 +0800

> 20 minutes includes time spent on hellos, introductions, asking if everyone has read the draft, jabber scribe, testing the audio, and all other kinds of administrivia. You've been to IETF sessions…

absolutely. Then we agree on the 20 min.

> To me the biggest gap in existing solutions is that they require kludges like GRE tunnels and route-based VPN, and also that they don't cover the provisioning of credentials. GRE tunnels and route-…

These are all very vague but generally misinformed statements.

> Downloadable presentations help people who are following remotely (like Chris) in case the audio does not fail.

we can share via webex if needed.

	fred

---

From: Yoav Nir <[email-masked]>
Date: Tue, 15 Nov 2011 11:03:01 +0200

> These are all very vague but generally misinformed statements.

I'm sorry if they have offended you or your company. 

My point remains, that IPsec does define a mechanism for tunneling packets. It's called "tunnel mode IPsec". That Cisco and perhaps other vendors choose to use other tunneling mechanisms such as GRE when they need some fancy features such as peer discovery or dynamic protected domain discovery, tells me that something is lacking in IPsec tunnels. That is what I meant by "kludge".

It may be that the problem with IPsec tunnels is not in the tunnels themselves, but that there are no configuration protocols associated with them, such as the routing protocols or such as NHRP that can be used with GRE tunnels. 

I will take your word that using GRE+NHRP can scale as far as anyone would like. However, in evaluating solutions, we should not automatically go with the analogy that IPsec VPNs are like overlay networks on top of the Internet, and that tunnels are analogous to links. GRE is an overhead that is added to every packet. NHRP is yet another protocol that needs to be implemented and carried over the IPsec SA. All that should be compared with cost and complexity of potential extensions to IKE and IPsec that would carry the same information.

We will have plenty of opportunity to discuss these things at the meeting on Wednesday, but just to make things clear, I am not advocating any solution, and I have no unsubmitted draft with some extension to IKE. The purpose of the meeting is to review the use cases and the solutions that currently exist. If anyone intends to pull out a new never-before-published solution that's fine as well, but I have no such intentions.

Yoav

---

From: Yoav Nir <[email-masked]>
Date: Wed, 16 Nov 2011 09:51:54 +0200

Hi.

Steve has come up with a formulation for the subject for discussion tonight:

In an environment with many IPsec gateways and remote clients that share an established trust infrastructure (single domain or multi-domain), customers want to get full mesh IPsec connectivity for efficiency. However, this cannot be feasibly accomplished only with today's IPsec and IKE due to problems with address lookup, reachability, policy configuration, etc. We aim to solve this problem in an interoperable manner using IPsec and IKE and other new or existing IETF standards.

The draft does contain other use cases, which I will mention in my presentation, but the above use case will get most of the attention. 

Those of you wishing to download the presentation material:
 - Original format (1.3 MB)
http://dl.dropbox.com/u/28687906/P2P-VPN.zip

 - Converted to PDF (56.3 MB)
http://dl.dropbox.com/u/28687906/P2P-VPN-PDF.zip

During the Plenary meeting (16:30-19:30 local time) I will be in the Jabber room most of the time, so if you remote participants want to test it, and say hi, go ahead.

Otherwise see y'all at 20:00 in room 101D.

Yoav