Subject: [IPsec] IPsecME virtual meeting minutes, and way forward with fragmentation

From: Yaron Sheffer <[email-masked]>
Date: Thu, 16 May 2013 19:57:27 +0300

Hi,

As promised, we just had a virtual interim meeting to discuss IKEv2 
fragmentation. Please see the minutes below (thanks Paul!).

Following up on this meeting, we would like to confirm the decision on 
the mailing list:

- The group still thinks this is an important problem that needs an 
interoperable solution.
- We would like to abandon the work on IKE-over-TCP.
- And to work on IKEv2 protocol-level fragmentation, using 
draft-smyslov-ipsecme-ikev2-fragmentation as a starting point.

Please send your approval, disapproval or comments to the list within a 
week (until May 23).

Thanks,
	Yaron

-------- Original Message --------
Subject: Proposed minutes for today

IPsecME WG
Virtual Interim Meeting, 2013-05-16
Minutes taken by Paul Hoffman

Yaron gave introduction
	Introduction superfluous
	We have little energy
	Maybe the draft should be individual draft with discussion on the list

Valery: is OK with this being Individual Submission
	Yoav: wants it to be a WG document
		Cisco has its own running code that is non-interoperable
	Brian: Cisco would have to do the eventual result anyway
	Yoav: Cisco is more likely to implement if they were part of the discussion

Yaron wonders if this is a problem that needs to be resolved
	Yoav: yes, and would rather work with an RFC
	Tero: the problem is still there, but it just won't be TCP
		The WG needs to have implementers reviews at the start

Yaron: do we want to stay with the current TCP-based solution?
	Brian: might be running on sensors that don't have a TCP stack
	Yoav: even he won't implement it

Yaron: is Valery's draft better than what several non-standard 
implementations of what IKEv1 did
	Yoav: just copying what IKEv1 did is probably wrong; doesn't know
	Valery: they implemented for IKEv1 based on Microsoft's implementation
		If we introduce negotiation in IKEv2, it won't be exactly the same
		The implementation will be different, but similar
	Brian: it looks very similar but using a Notify for signaling, which is 
an advantage

Next steps:
	Ask the WG
		Abandon IKE TCP
		Adopt Valery's draft

Blue sheet:
	Brian Weis
	Daneil Migault
	Paul Hoffman
	Tero Kivinen
	Valery Smyslov
	Yaron Sheffer
	Yoav Nir

---

From: Paul Wouters <[email-masked]>
Date: Thu, 16 May 2013 13:08:05 -0400 (EDT)

On Thu, 16 May 2013, Yaron Sheffer wrote:

> Following up on this meeting, we would like to confirm the decision on the 
> mailing list:
>

Sorry I missed the meeting. I approve of the conclusions reached.

Paul

---

From: Daniel Migault <[email-masked]>
Date: Thu, 16 May 2013 19:51:54 +0200

I am supporting IKE fragmentation supported by the application and thus
support draft-smyslov-ipsecme-ikev2-fragmentation.

BR
Daniel

On Thu, May 16, 2013 at 7:08 PM, Paul Wouters <[email-masked]> wrote:

>> draft-smyslov-ipsecme-ikev2-**fragmentation as a starting point.
>>
>
> ______________________________**_________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/**listinfo/ipsec<https://www.ietf.org/mailman/listinfo/ipsec>
>

-- 
Daniel Migault
Orange Labs -- Security
+33 6 70 72 69 58

---

From: Tero Kivinen <[email-masked]>
Date: Thu, 16 May 2013 21:57:43 +0300

> Please send your approval, disapproval or comments to the list within a 

I approve the decision to take that draft as starting point. I have
earlier said I do not care wheter it is TCP or fragmentation, but I
think the problem is something that needs to be solved, and I would
prefer to have just one standardized way to solve it.
-- 
[email-masked]

---

From: "Valery Smyslov" <[email-masked]>
Date: Thu, 16 May 2013 23:43:52 +0400

Hi,

I approved the conclusion.

Regards,
Valery.

---

From: Yoav Nir <[email-masked]>
Date: Thu, 16 May 2013 19:46:00 +0000

+1

On May 16, 2013, at 10:43 PM, Valery Smyslov <[email-masked]>
 wrote:

>> - The group still thinks this is an important problem that needs an interoperable solution.
>> - And to work on IKEv2 protocol-level fragmentation, using draft-smyslov-ipsecme-ikev2-fragmentation as a starting point.
>> Please send your approval, disapproval or comments to the list within a week (until May 23).
>

---

From: Brian Weis <[email-masked]>
Date: Thu, 16 May 2013 16:54:51 -0700

On May 16, 2013, at 9:57 AM, Yaron Sheffer <[email-masked]> wrote:

> Hi,
> 
> As promised, we just had a virtual interim meeting to discuss IKEv2 fragmentation. Please see the minutes below (thanks Paul!).
> 
> Following up on this meeting, we would like to confirm the decision on the mailing list:
> 

I approve.

[snip]

> 	Brian: might be running on sensors that don't have a TCP stack

Someone made this comment, but it wasn't me. 

I did mention that the current TCP-based solution has the advantage of only re-sending the missing TCP segment, whereas current and proposed UDP-based fragmentation solutions re-send all packet fragments. That could be valuable for a VPN gateway with many peers with a lossy network. But that doesn't seem enough of a justification to stay with the current TCP-based solution.

Brian

---

From: Yoav Nir <[email-masked]>
Date: Fri, 17 May 2013 08:08:33 +0000

> Someone made this comment, but it wasn't me. 

That was Daniel.

Yoav

---

From: daniel migault <[email-masked]>
Date: Fri, 17 May 2013 10:45:43 +0200

yes, that was me.

Daniel
On 05/17/2013 10:08 AM, Yoav Nir wrote:
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec

---

From: "Rajeshwar Singh Jenwar (rsj)" <[email-masked]>
Date: Sun, 19 May 2013 03:05:31 +0000

+1

Kind Regards,
Raj

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Brian Weis (bew)
Sent: Friday, May 17, 2013 5:25 AM
To: Yaron Sheffer
Cc: IPsecme WG
Subject: Re: [IPsec] IPsecME virtual meeting minutes, and way forward with fragmentation

I approve.

[snip]

Brian