Subject: Re: [IPsec] I-D Action: draft-ietf-ipsecme-ddos-protection-00.txt

From: "Graham Bartlett (grbartle)" <[email-masked]>
Date: Wed, 26 Nov 2014 20:05:13 +0000

Hi Yoav

Here's some words I penned regarding some ideas I had to compliment your
RFC.

cheers

RFC5685 describes the use of IKEv2 redirect to a client to another VPN
gateway. For large scale implementations this can be used to redirect a
client to a geographically closer gateway, thereby group clients by
location. Eg. A client in London will initially request a session to
vpn.example.com, based on the clients source IP address they are
redirected to the European VPN gateway (eu.vpn.example.com), which only
serves clients from Europe and prevents any non-European IP addresses
connecting. Using this method geographically grouped IP addresses can be
grouped to gateways, therefore preventing attackers not in the geographic
group from connecting. This obviously doesn't prevent attackers from
spoofing an IP address which would be accepted by the gateway. By limiting
clients by location, IP TTL security mechanisms can be employed to accept
certain connections from hosts a small number of hops away, therefore
assisting to mitigate an attack from hosts distributed over the globe.

On 27/10/2014 21:48, "[email-masked]" <[email-masked]>
wrote:

>
>A New Internet-Draft is available from the on-line Internet-Drafts
>directories.
> This draft is a work item of the IP Security Maintenance and Extensions
>Working Group of the IETF.
>
>        Title           : Protecting Internet Key Exchange (IKE)
>Implementations from Distributed Denial of Service Attacks
>        Author          : Yoav Nir
>	Filename        : draft-ietf-ipsecme-ddos-protection-00.txt
>	Pages           : 12
>	Date            : 2014-10-27
>
>Abstract:
>   This document recommends implementation and configuration best
>   practices for Internet-connected IPsec Responders, to allow them to
>   resist Denial of Service and Distributed Denial of Service attacks.
>   Additionally, the document introduces a new mechanism called "Client
>   Puzzles" that help accomplish this task.
>
>
>The IETF datatracker status page for this draft is:
>https://datatracker.ietf.org/doc/draft-ietf-ipsecme-ddos-protection/
>
>There's also a htmlized version available at:
>http://tools.ietf.org/html/draft-ietf-ipsecme-ddos-protection-00
>
>
>Please note that it may take a couple of minutes from the time of
>submission
>until the htmlized version and diff are available at tools.ietf.org.
>
>Internet-Drafts are also available by anonymous FTP at:
>ftp://ftp.ietf.org/internet-drafts/
>
>_______________________________________________
>IPsec mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/ipsec