Subject: Re: draft-ietf-ospf-ospfv3-auth-04.txt

From: Vishwas Manral <[email-masked]>
Date: Mon, 5 Jul 2004 22:41:54 -0700

Hi Abhay,

Good point, didnt know the draft was actually out(actually I think Sina/Michael actually started working on it togather a long long while back before the idea was dropped). Just curious would we still use IPSec or would we use the current authentication mechanism?

To add further, we intend to add a draft to allow out of order sequence of packets with authentication enabled like in IPSec for OSPFv2 too. (IP does not guarentee inorder dilevery anyway/besides we can allow for packet prioritization)

Thanks,
Vishwas

-----Original Message-----
From: Mailing List [mailto:[email-masked]]On Behalf Of Abhay
Roy
Sent: Tuesday, July 06, 2004 11:04 AM
To: [email-masked]
Subject: Re: draft-ietf-ospf-ospfv3-auth-04.txt

On 07/05/04-0500 at 2:19pm, [email-masked] writes:

> Hi Vishwas,
>
> Thanks for the comments.  Please see my comments inline..
>
> > 1. I am not sure we should have a statement which says OSPFv3
> > is only for IPv6.
> > "As OSPFv2 is only for IPv4 and OSPFv3 is only for IPv6,
> > the distinction between the packets can be easily made by
> > IP version. "
>
> Do you have a replacement statement that you would prefer ?
> As the IP protocol type value for OSPF and OSPFv3 is same,
> we have to depend upon the IP version to separate OSPF and
> OSPFv3 packets.

Just FYI, we can run OSPFv3 using IPv4 transport (see section 9 of
draft-mirtorabi-ospfv3-af-alt-01.txt). In which case the demux
will be based on OSPF protocol version.

Regards,
-Roy-

---

From: Abhay Roy <[email-masked]>
Date: Sun, 11 Jul 2004 13:09:09 -0700

Vishwas,

As the draft stands today, it doesn't venture into the security
mechanism(s). I guess we need to add something. My preference will
be to stick with IPSec even for OSPFv3 IPv4 AF (irrespective of
ipv4 or ipv6 transport).

Regards,
-Roy-

On 07/05/04-0700 at 10:41pm, Vishwas Manral writes:

> Hi Abhay,
>
> Good point, didnt know the draft was actually out(actually I
> think Sina/Michael actually started working on it togather a
> long long while back before the idea was dropped). Just curious
> would we still use IPSec or would we use the current
> authentication mechanism?
>
> To add further, we intend to add a draft to allow out of order
> sequence of packets with authentication enabled like in IPSec
> for OSPFv2 too. (IP does not guarentee inorder dilevery
> anyway/besides we can allow for packet prioritization)
>
> Thanks,
> Vishwas
>