Subject: Re: [IPsec] using BGP signaling to achieve IPsec Tunnel configuration (draft-hujun-idr-bgp-ipsec): potential conflict with the I2NSF's Controller facilitated IPsec configuration

From: Fernando Pereñíguez García <[email-masked]>
Date: Tue, 2 Apr 2019 00:04:41 +0200

Hi Linda,

We have revised draft-hujun-idr-bgp-ipsec and, to the best of our
understanding, we do not see any conflict with our draft being discussed in
I2NSF. The IPsec attributes configured through BGP are only the peer’s
tunnel address and local/remote subnet prefixes (that are used for the
traffic selectors).  The rest of the IPsec configuration (AH/ESP,
cryptographic algorithms, keys, etc.) are obtained via a “color mapping”,
which is something not covered by the draft since it assumes routers are
somehow pre-provisioned with this information.

Thus, we do not see this draft is also facing the task of formalizing the
complete configuration of an IPsec device. We appreciate any clarification
in case we are wrong.

Best regards,
Fernando.

El jue., 28 mar. 2019 a las 16:01, Linda Dunbar (<[email-masked]>)
escribió:

>
>
> Just to reiterate the concerns and issues I raised during IDR Thurs
> session discussion on using BGP signaling to achieve IPsec Tunnel
> configuration (draft-hujun-idr-bgp-ipsec).
>
> Copy I2NSF WG because there is similar discussion for over a year.
>
> Copy IPsecme WG as the group has many experts on the IPsec configuration.
>
>
>
> 1.      I2NSF WG has an on-going discussion on Controller facilitated
> IPsec configuration which has been discussed for over a year.  Even though
> the I2NSF’s  IPsec Configuration is between Controller and devices, whereas
> the BGP signaling IPsec Configuration proposed by draft-hujun-idr-bgp-ipsec
> is between peers, the configuration parameters to the devices are for the
> same purpose, therefore, should be aligned to avoid future conflicts to the
> industry.
>
>
>
> 2.      When using IPsec Tunnel between two peers, usually they are
> separated by untrusted domain. If Router “A” is allowed to  gets the IPsec
> tunnel configurations from peers across untrusted domain (instead of the
> today’s practice of from administrators), then many issues come up, for
> example:
>
>
>
> How can a router “A” trust the Traffic Selection policy from a remote peer
> B? If the router “A” already has its Traffic Selection policy configured
> for a specific IPsec tunnel, but different from the Traffic Selection
> policy from remote peer B, which policy should Route A enforce for the
> IPsec Tunnel?  If the router “A” doesn’t have Traffic Selection policy
> specified, there are two remote nodes B & C signaling the “A” with
> different Traffic Selection policy, what should A do?
>
>
>
> 3.      RFC5566 only specifies a simple indication of IPsec Encap, but
> doesn’t do any of the IPsec configuration portion.
>
>
>
>
>
> As indicated by BESS WG chair, there are multiple drafts addressing IPsec
> in BESS, IDR, and WGs in Security Area, involved Chairs and ADs may need to
> agree where is the home for continuing the discussion to avoid future
> conflicts.
>
>
>
>
>
> Cheers,
>
> Linda Dunbar
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec
>

-- 
----------------------------------------------------------------------------------------------------
Fernando Pereñíguez García, PhD
Department of Sciences and Informatics
University Defense Center, (CUD), Spanish Air Force Academy, MDE-UPCT
C/ Coronel Lopez Peña, s/n, 30720, San Javier, Murcia - SPAIN
Tel: +34 968 189 946 Fax: +34 968 189 970
------------------------------------------------------------------------------------------------------

---

From: "Hu, Jun (Nokia - US/Mountain View)" <[email-masked]>
Date: Mon, 1 Apr 2019 22:21:31 +0000

Again, Linda, as discussed with you multiple times, my draft is really about extending current draft-ietf-idr-tunnel-encaps<https://datatracker.ietf.org/doc/draft-ietf-idr-tunnel-encaps/> to cover IPsec tunnel and other encryption tunnel like DTLS in next revsion (based on the feedback I got from Prague);
My draft is not intended to address SDN for IPsec use case and it does not require a central controller, and there are use cases where a central controller is not needed or can’t be used, my draft is intended for those cases;

So I really don’t see any conflict here

From: IPsec <[email-masked]> On Behalf Of Fernando Pere?íguez García
Sent: Monday, April 1, 2019 3:05 PM
To: Linda Dunbar <[email-masked]>
Cc: Roman Danyliw <[email-masked]>; idr wg <[email-masked]>; [email-masked]; [email-masked]; [email-masked]; Gabriel López Millán <[email-masked]>; Yoav Nir <[email-masked]>; Alvaro Retana <[email-masked]>; [email-masked] WG <[email-masked]>; Benjamin Kaduk <[email-masked]>; Rafa Marin Lopez <[email-masked]>; Paul Wouters <[email-masked]>
Subject: Re: [IPsec] using BGP signaling to achieve IPsec Tunnel configuration (draft-hujun-idr-bgp-ipsec): potential conflict with the I2NSF's Controller facilitated IPsec configuration

Hi Linda,

We have revised draft-hujun-idr-bgp-ipsec and, to the best of our understanding, we do not see any conflict with our draft being discussed in I2NSF. The IPsec attributes configured through BGP are only the peer’s tunnel address and local/remote subnet prefixes (that are used for the traffic selectors).  The rest of the IPsec configuration (AH/ESP, cryptographic algorithms, keys, etc.) are obtained via a “color mapping”, which is something not covered by the draft since it assumes routers are somehow pre-provisioned with this information.

Thus, we do not see this draft is also facing the task of formalizing the complete configuration of an IPsec device. We appreciate any clarification in case we are wrong.

Best regards,
Fernando..

El jue., 28 mar. 2019 a las 16:01, Linda Dunbar (<[email-masked]<mailto:[email-masked]>>) escribió:

Just to reiterate the concerns and issues I raised during IDR Thurs session discussion on using BGP signaling to achieve IPsec Tunnel configuration (draft-hujun-idr-bgp-ipsec).
Copy I2NSF WG because there is similar discussion for over a year.
Copy IPsecme WG as the group has many experts on the IPsec configuration.

1.      I2NSF WG has an on-going discussion on Controller facilitated IPsec configuration which has been discussed for over a year.  Even though the I2NSF’s  IPsec Configuration is between Controller and devices, whereas the BGP signaling IPsec Configuration proposed by draft-hujun-idr-bgp-ipsec is between peers, the configuration parameters to the devices are for the same purpose, therefore, should be aligned to avoid future conflicts to the industry.

2.      When using IPsec Tunnel between two peers, usually they are separated by untrusted domain. If Router “A” is allowed to  gets the IPsec tunnel configurations from peers across untrusted domain (instead of the today’s practice of from administrators), then many issues come up, for example:

How can a router “A” trust the Traffic Selection policy from a remote peer B? If the router “A” already has its Traffic Selection policy configured for a specific IPsec tunnel, but different from the Traffic Selection policy from remote peer B, which policy should Route A enforce for the IPsec Tunnel?  If the router “A” doesn’t have Traffic Selection policy specified, there are two remote nodes B & C signaling the “A” with different Traffic Selection policy, what should A do?

3.      RFC5566 only specifies a simple indication of IPsec Encap, but doesn’t do any of the IPsec configuration portion.

As indicated by BESS WG chair, there are multiple drafts addressing IPsec in BESS, IDR, and WGs in Security Area, involved Chairs and ADs may need to agree where is the home for continuing the discussion to avoid future conflicts.

Cheers,
Linda Dunbar
_______________________________________________
IPsec mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/ipsec

---

From: "Xialiang (Frank, Network Standard & Patent Dept)" <[email-masked]>
Date: Tue, 2 Apr 2019 01:52:16 +0000

Hi Jun,
My personal view is no matter which use cases (SDN-based or BGP-based) you are for, the basic goal is to configure/distribute the IPSec parameters between the associated peers, for next step IKEv2 session negotiation. That is why all these related drafts should be aligned in certain way.

B.R.
Frank

发件人: I2nsf [mailto:[email-masked]] 代表 Hu, Jun (Nokia - US/Mountain View)
发送时间: 2019年4月2日 6:22
收件人: Fernando Pereñíguez García <[email-masked]>; Linda Dunbar <[email-masked]>
抄送: Roman Danyliw <[email-masked]>; idr wg <[email-masked]>; [email-masked]; [email-masked]; [email-masked]; Gabriel López Millán <[email-masked]>; Yoav Nir <[email-masked]>; Alvaro Retana <[email-masked]>; [email-masked] WG <[email-masked]>; Benjamin Kaduk <[email-masked]>; Rafa Marin Lopez <[email-masked]>; Paul Wouters <[email-masked]>
主题: Re: [I2nsf] [IPsec] using BGP signaling to achieve IPsec Tunnel configuration (draft-hujun-idr-bgp-ipsec): potential conflict with the I2NSF's Controller facilitated IPsec configuration

From: IPsec <[email-masked]<mailto:[email-masked]>> On Behalf Of Fernando Pere?íguez García
Sent: Monday, April 1, 2019 3:05 PM
To: Linda Dunbar <[email-masked]<mailto:[email-masked]>>
Cc: Roman Danyliw <[email-masked]<mailto:[email-masked]>>; idr wg <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; Gabriel López Millán <[email-masked]<mailto:[email-masked]>>; Yoav Nir <[email-masked]<mailto:[email-masked]>>; Alvaro Retana <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]> WG <[email-masked]<mailto:[email-masked]>>; Benjamin Kaduk <[email-masked]<mailto:[email-masked]>>; Rafa Marin Lopez <[email-masked]<mailto:[email-masked]>>; Paul Wouters <[email-masked]<mailto:[email-masked]>>
Subject: Re: [IPsec] using BGP signaling to achieve IPsec Tunnel configuration (draft-hujun-idr-bgp-ipsec): potential conflict with the I2NSF's Controller facilitated IPsec configuration

Hi Linda,

Best regards,
Fernando..

Cheers,
Linda Dunbar

---

From: Robert Raszuk <[email-masked]>
Date: Tue, 2 Apr 2019 10:31:34 +0200

Hi Frank,

This draft does not talk about distributing any security related
parameters. Maybe the name is a bit confusing as for some it means to be
IPSec related.

We have discussed the draft in Prague and agreed to also extend it with
other types of secure encap.

I have not discussed it with other authors but perhaps a much proper name
and clearly less controversial would be:
*draft-hujun-idr-encrypted-transport-autodiscovery* or *draft-hujun-idr-eta*
(for short) or something along those lines to reflect what this work is
really about and how it differs from other proposals.

Thx,
R.

On Tue, Apr 2, 2019 at 3:52 AM Xialiang (Frank, Network Standard & Patent
Dept) <[email-masked]> wrote:

> Hi Jun,
>
> My personal view is no matter which use cases (SDN-based or BGP-based) you
> are for, the basic goal is to configure/distribute the IPSec parameters
> between the associated peers, for next step IKEv2 session negotiation. That
> is why all these related drafts should be aligned in certain way.
>
>
>
> B.R.
>
> Frank
>
>
>
> *发件人:* I2nsf [mailto:[email-masked]] *代表 *Hu, Jun (Nokia -
> US/Mountain View)
> *发送时间:* 2019年4月2日 6:22
> *收件人:* Fernando Pereñíguez García <[email-masked]>;
> Linda Dunbar <[email-masked]>
> *抄送:* Roman Danyliw <[email-masked]>; idr wg <[email-masked]>;
> [email-masked]; [email-masked]; [email-masked];
> Gabriel López Millán <[email-masked]>; Yoav Nir <[email-masked]>;
> Alvaro Retana <[email-masked]>; [email-masked] WG <[email-masked]>;
> Benjamin Kaduk <[email-masked]>; Rafa Marin Lopez <[email-masked]>; Paul
> Wouters <[email-masked]>
> *主题:* Re: [I2nsf] [IPsec] using BGP signaling to achieve IPsec Tunnel
> configuration (draft-hujun-idr-bgp-ipsec): potential conflict with the
> I2NSF's Controller facilitated IPsec configuration
>
>
>
> Again, Linda, as discussed with you multiple times, my draft is really
> about extending current draft-ietf-idr-tunnel-encaps
> <https://datatracker.ietf.org/doc/draft-ietf-idr-tunnel-encaps/> to cover
> IPsec tunnel and other encryption tunnel like DTLS in next revsion (based
> on the feedback I got from Prague);
>
> My draft is not intended to address SDN for IPsec use case and it does not
> require a central controller, and there are use cases where a central
> controller is not needed or can’t be used, my draft is intended for those
> cases;
>
>
>
> *From:* IPsec <[email-masked]> *On Behalf Of *Fernando Pere?íguez
> García
> *Sent:* Monday, April 1, 2019 3:05 PM
> *To:* Linda Dunbar <[email-masked]>
> *Cc:* Roman Danyliw <[email-masked]>; idr wg <[email-masked]>;
> [email-masked]; [email-masked]; [email-masked];
> Gabriel López Millán <[email-masked]>; Yoav Nir <[email-masked]>;
> Alvaro Retana <[email-masked]>; [email-masked] WG <[email-masked]>;
> Benjamin Kaduk <[email-masked]>; Rafa Marin Lopez <[email-masked]>; Paul
> Wouters <[email-masked]>
> *Subject:* Re: [IPsec] using BGP signaling to achieve IPsec Tunnel
> configuration (draft-hujun-idr-bgp-ipsec): potential conflict with the
> I2NSF's Controller facilitated IPsec configuration
>
>
>
> Hi Linda,
>
>
>
> I2nsf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/i2nsf
>

---

From: "Xialiang (Frank, Network Standard & Patent Dept)" <[email-masked]>
Date: Tue, 2 Apr 2019 09:20:58 +0000

Hi Robert,
Thanks for further clarification, it helps for me.
Again, I think the key point is not the original use case, but the function gaps each draft can fill in.

B.R.
Frank

发件人: Robert Raszuk [mailto:[email-masked]]
发送时间: 2019年4月2日 16:32
收件人: Xialiang (Frank, Network Standard & Patent Dept) <[email-masked]>
抄送: Hu, Jun (Nokia - US/Mountain View) <[email-masked]>; Fernando Pereñíguez García <[email-masked]>; Linda Dunbar <[email-masked]>; Roman Danyliw <[email-masked]>; idr wg <[email-masked]>; [email-masked]; [email-masked]; [email-masked]; Gabriel López Millán <[email-masked]>; Yoav Nir <[email-masked]>; Alvaro Retana <[email-masked]>; [email-masked] WG <[email-masked]>; Benjamin Kaduk <[email-masked]>; Rafa Marin Lopez <[email-masked]>; Paul Wouters <[email-masked]>
主题: Re: [I2nsf] 答复: [IPsec] using BGP signaling to achieve IPsec Tunnel configuration (draft-hujun-idr-bgp-ipsec): potential conflict with the I2NSF's Controller facilitated IPsec configuration

Hi Frank,

This draft does not talk about distributing any security related parameters. Maybe the name is a bit confusing as for some it means to be IPSec related.

We have discussed the draft in Prague and agreed to also extend it with other types of secure encap.

I have not discussed it with other authors but perhaps a much proper name and clearly less controversial would be:
draft-hujun-idr-encrypted-transport-autodiscovery or draft-hujun-idr-eta (for short) or something along those lines to reflect what this work is really about and how it differs from other proposals.

Thx,
R.

On Tue, Apr 2, 2019 at 3:52 AM Xialiang (Frank, Network Standard & Patent Dept) <[email-masked]<mailto:[email-masked]>> wrote:
Hi Jun,
My personal view is no matter which use cases (SDN-based or BGP-based) you are for, the basic goal is to configure/distribute the IPSec parameters between the associated peers, for next step IKEv2 session negotiation. That is why all these related drafts should be aligned in certain way.

B.R.
Frank

发件人: I2nsf [mailto:[email-masked]<mailto:[email-masked]>] 代表 Hu, Jun (Nokia - US/Mountain View)
发送时间: 2019年4月2日 6:22
收件人: Fernando Pereñíguez García <[email-masked]<mailto:[email-masked]>>; Linda Dunbar <[email-masked]<mailto:[email-masked]>>
抄送: Roman Danyliw <[email-masked]<mailto:[email-masked]>>; idr wg <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; Gabriel López Millán <[email-masked]<mailto:[email-masked]>>; Yoav Nir <[email-masked]<mailto:[email-masked]>>; Alvaro Retana <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]> WG <[email-masked]<mailto:[email-masked]>>; Benjamin Kaduk <[email-masked]<mailto:[email-masked]>>; Rafa Marin Lopez <[email-masked]<mailto:[email-masked]>>; Paul Wouters <[email-masked]<mailto:[email-masked]>>
主题: Re: [I2nsf] [IPsec] using BGP signaling to achieve IPsec Tunnel configuration (draft-hujun-idr-bgp-ipsec): potential conflict with the I2NSF's Controller facilitated IPsec configuration

Hi Linda,

Best regards,
Fernando..

Cheers,
Linda Dunbar

[email-masked]<mailto:[email-masked]>

---

From: Alvaro Retana <[email-masked]>
Date: Tue, 2 Apr 2019 10:20:01 -0400

On April 2, 2019 at 5:21:09 AM, Xialiang (Frank, Network Standard & Patent
Dept) ([email-masked]) wrote:

[Trimmed individual addresses and consolidated (sec-ads, i2nsf-chairs) to
avoid a bounce  + bess-chairs + rtg-ads.]

Hi!

Thank you all for the discussion.  I’m replying to this message to pick on
what Frank said…but in reality is a general reply to the thread.

the key point is...the function gaps each draft can fill in.

Because there are several drafts that may overlap in function and content,
I have asked John/Sue (idr-chairs) to work with Stephane/Matthew
(bess-chairs) in figuring out the overlaps and helping the authors (if
needed) to rationalize what should go forward and what is not needed
because it may be a duplicate…at least starting from the RTG area point of
view.

Once the consolidation is done, we should have a clearer picture on the
type of interaction we need to have with i2nsf/ipsecme.

Since we’re all just getting back from Prague, please give the Chairs a
little bit of time.

Thanks!

Alvaro.

---

From: "Hu, Jun (Nokia - US/Mountain View)" <[email-masked]>
Date: Tue, 2 Apr 2019 21:23:37 +0000

However the use case does drive the design of the protocol, e.g. for SDN case, you might want separate every part of Ipsec (or other type of encryption) tunnel config so that controller has the flexibility to provision each of them differently on different node, and if you want to use BGP as the provision protocol, then that’s a quite lot a extensions to BGP;
While in other non SDN case, user might want a solution with least changes to BGP and least information advertised by each node, so you might want group multiple parts of tunnel configuration into a single part (e.g. the color sub-TLV in my draft)

From: Xialiang (Frank, Network Standard & Patent Dept) <[email-masked]>
Sent: Tuesday, April 2, 2019 2:21 AM
To: Robert Raszuk <[email-masked]>
Cc: Hu, Jun (Nokia - US/Mountain View) <[email-masked]>; Fernando Pereñíguez García <[email-masked]>; Linda Dunbar <[email-masked]>; Roman Danyliw <[email-masked]>; idr wg <[email-masked]>; [email-masked]; [email-masked]; [email-masked]; Gabriel López Millán <[email-masked]>; Yoav Nir <[email-masked]>; Alvaro Retana <[email-masked]>; [email-masked] WG <[email-masked]>; Benjamin Kaduk <[email-masked]>; Rafa Marin Lopez <[email-masked]>; Paul Wouters <[email-masked]>
Subject: 答复: [I2nsf] 答复: [IPsec] using BGP signaling to achieve IPsec Tunnel configuration (draft-hujun-idr-bgp-ipsec): potential conflict with the I2NSF's Controller facilitated IPsec configuration

Hi Robert,

B.R.
Frank

发件人: Robert Raszuk [mailto:[email-masked]]
发送时间: 2019年4月2日 16:32
收件人: Xialiang (Frank, Network Standard & Patent Dept) <[email-masked]<mailto:[email-masked]>>
抄送: Hu, Jun (Nokia - US/Mountain View) <[email-masked]<mailto:[email-masked]>>; Fernando Pereñíguez García <[email-masked]<mailto:[email-masked]>>; Linda Dunbar <[email-masked]<mailto:[email-masked]>>; Roman Danyliw <[email-masked]<mailto:[email-masked]>>; idr wg <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; Gabriel López Millán <[email-masked]<mailto:[email-masked]>>; Yoav Nir <[email-masked]<mailto:[email-masked]>>; Alvaro Retana <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]> WG <[email-masked]<mailto:[email-masked]>>; Benjamin Kaduk <[email-masked]<mailto:[email-masked]>>; Rafa Marin Lopez <[email-masked]<mailto:[email-masked]>>; Paul Wouters <[email-masked]<mailto:[email-masked]>>
主题: Re: [I2nsf] 答复: [IPsec] using BGP signaling to achieve IPsec Tunnel configuration (draft-hujun-idr-bgp-ipsec): potential conflict with the I2NSF's Controller facilitated IPsec configuration

Hi Frank,

Thx,
R.

B.R.
Frank

Hi Linda,

Best regards,
Fernando..

Cheers,
Linda Dunbar

---

From: Linda Dunbar <[email-masked]>
Date: Wed, 3 Apr 2019 16:36:05 +0000

Jun,

For example, the SPD for IPsec Traffic Selection instructed by the controller as specified by  https://datatracker.ietf.org/doc/draft-ietf-i2nsf-sdn-ipsec-flow-protection/  can conflict from the TS sent from the BGP peers. What should the node do? Listen to its peers for Traffic selection for an IPsec tunnel, or listen to its controller (or its administrator)?

Unlike attached routes discovery, IPsec TS is usually configured by nodes’ administer or Controller. That is probably why RFC5566 doesn’t cover any of those aspects.

Best regards,

Linda

From: Xialiang (Frank, Network Standard & Patent Dept)
Sent: Monday, April 01, 2019 8:52 PM
To: Hu, Jun (Nokia - US/Mountain View) <[email-masked]>; Fernando Pereñíguez García <[email-masked]>; Linda Dunbar <[email-masked]>
Cc: Roman Danyliw <[email-masked]>; idr wg <[email-masked]>; [email-masked]; [email-masked]; [email-masked]; Gabriel López Millán <[email-masked]>; Yoav Nir <[email-masked]>; Alvaro Retana <[email-masked]>; [email-masked] WG <[email-masked]>; Benjamin Kaduk <[email-masked]>; Rafa Marin Lopez <[email-masked]>; Paul Wouters <[email-masked]>
Subject: 答复: [IPsec] using BGP signaling to achieve IPsec Tunnel configuration (draft-hujun-idr-bgp-ipsec): potential conflict with the I2NSF's Controller facilitated IPsec configuration

Hi Jun,

B.R.
Frank

Hi Linda,

Best regards,
Fernando..

Cheers,
Linda Dunbar

---

From: Linda Dunbar <[email-masked]>
Date: Wed, 3 Apr 2019 16:38:33 +0000

p.s. meant to include
https://datatracker.ietf.org/doc/draft-ietf-i2nsf-sdn-ipsec-flow-protection/ already has:

Linda

From: Linda Dunbar
Sent: Wednesday, April 03, 2019 11:36 AM
To: Xialiang (Frank, Network Standard & Patent Dept) <[email-masked]>; Hu, Jun (Nokia - US/Mountain View) <[email-masked]>; Fernando Pereñíguez García <[email-masked]>
Cc: Roman Danyliw <[email-masked]>; idr wg <[email-masked]>; [email-masked]; [email-masked]; [email-masked]; Gabriel López Millán <[email-masked]>; Yoav Nir <[email-masked]>; Alvaro Retana <[email-masked]>; [email-masked] WG <[email-masked]>; Benjamin Kaduk <[email-masked]>; Rafa Marin Lopez <[email-masked]>; Paul Wouters <[email-masked]>
Subject: RE: [IPsec] using BGP signaling to achieve IPsec Tunnel configuration (draft-hujun-idr-bgp-ipsec): potential conflict with the I2NSF's Controller facilitated IPsec configuration

Jun,

Best regards,

Linda

To: Hu, Jun (Nokia - US/Mountain View) <[email-masked]<mailto:[email-masked]>>; Fernando Pereñíguez García <[email-masked]<mailto:[email-masked]>>; Linda Dunbar <[email-masked]<mailto:[email-masked]>>

Hi Jun,

B.R.
Frank

Hi Linda,

Best regards,
Fernando..

Cheers,
Linda Dunbar

---

From: "Hu, Jun (Nokia - US/Mountain View)" <[email-masked]>
Date: Wed, 3 Apr 2019 19:28:11 +0000

I think this totally depends on how operator choose to provision these configs; however I don’t think a node provisioned by a controller also accepts IPsec config from BGP is a typical case, even if someone chose to do that, he could chose to use one provision mechanism for some part traffic while another mechanism for other traffic, so that there is no conflicts;

From: Linda Dunbar <[email-masked]>
Sent: Wednesday, April 3, 2019 9:39 AM
To: Xialiang (Frank, Network Standard & Patent Dept) <[email-masked]>; Hu, Jun (Nokia - US/Mountain View) <[email-masked]>; Fernando Pereñíguez García <[email-masked]>
Cc: Roman Danyliw <[email-masked]>; idr wg <[email-masked]>; [email-masked]; [email-masked]; [email-masked]; Gabriel López Millán <[email-masked]>; Yoav Nir <[email-masked]>; Alvaro Retana <[email-masked]>; [email-masked] WG <[email-masked]>; Benjamin Kaduk <[email-masked]>; Rafa Marin Lopez <[email-masked]>; Paul Wouters <[email-masked]>
Subject: RE: [IPsec] using BGP signaling to achieve IPsec Tunnel configuration (draft-hujun-idr-bgp-ipsec): potential conflict with the I2NSF's Controller facilitated IPsec configuration

p.s. meant to include

Linda

From: Linda Dunbar
Sent: Wednesday, April 03, 2019 11:36 AM
To: Xialiang (Frank, Network Standard & Patent Dept) <[email-masked]<mailto:[email-masked]>>; Hu, Jun (Nokia - US/Mountain View) <[email-masked]<mailto:[email-masked]>>; Fernando Pereñíguez García <[email-masked]<mailto:[email-masked]>>
Cc: Roman Danyliw <[email-masked]<mailto:[email-masked]>>; idr wg <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; Gabriel López Millán <[email-masked]<mailto:[email-masked]>>; Yoav Nir <[email-masked]<mailto:[email-masked]>>; Alvaro Retana <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]> WG <[email-masked]<mailto:[email-masked]>>; Benjamin Kaduk <[email-masked]<mailto:[email-masked]>>; Rafa Marin Lopez <[email-masked]<mailto:[email-masked]>>; Paul Wouters <[email-masked]<mailto:[email-masked]>>
Subject: RE: [IPsec] using BGP signaling to achieve IPsec Tunnel configuration (draft-hujun-idr-bgp-ipsec): potential conflict with the I2NSF's Controller facilitated IPsec configuration

Jun,

Best regards,

Linda

Hi Jun,

B.R.
Frank

Hi Linda,

Best regards,
Fernando..

Cheers,
Linda Dunbar