From owner-ietf-ipsra@mail.vpnc.org Wed Dec 5 22:46:06 2001 Received: from above.proper.com (above.proper.com [208.184.76.39]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA29537 for ; Wed, 5 Dec 2001 22:46:05 -0500 (EST) Received: from localhost (localhost [[UNIX: localhost]]) by above.proper.com (8.11.6/8.11.3) id fB632QE15810 for ietf-ipsra-bks; Wed, 5 Dec 2001 19:02:26 -0800 (PST) Received: from [165.227.249.20] (165-227-249-20.client.dsl.net [165.227.249.20]) by above.proper.com (8.11.6/8.11.3) with ESMTP id fB632O215806 for ; Wed, 5 Dec 2001 19:02:24 -0800 (PST) Mime-Version: 1.0 X-Sender: phoffvpnc@mail.vpnc.org Message-Id: Date: Wed, 5 Dec 2001 19:02:23 -0800 To: ietf-ipsra@vpnc.org From: Paul Hoffman / VPNC Subject: Reminder: PIC last call Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: owner-ietf-ipsra@mail.vpnc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: Greetings again. There have been only one comment to date on the new PIC draft, which is in WG last call, and that was from one of the co-authors. The list of changes from -03 to -04 include: - Introduced optional transport over TCP to avoid packet fragmentation. - Added another message round for DoS protection. - Hash computations now include the complete ISAKMP header. - Better handling of authentication failures. Please read over the draft, which you can find at . Please make sure that the changes do what they say they are supposed to do, and that the security of the protocol has been maintained. Of course, please send comments to the list. (There will be at least one more draft before sending this to the IESG, since the authors have not done a complete IANA considerations section, but those changes will not affect any of the protocol.) --Paul Hoffman, Director --VPN Consortium From owner-ietf-ipsra@mail.vpnc.org Tue Dec 11 13:27:28 2001 Received: from above.proper.com (above.proper.com [208.184.76.39]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA22260 for ; Tue, 11 Dec 2001 13:27:27 -0500 (EST) Received: by above.proper.com (8.11.6/8.11.3) id fBBHY5g03536 for ietf-ipsra-bks; Tue, 11 Dec 2001 09:34:05 -0800 (PST) Received: from motgate3.mot.com (motgate3.mot.com [144.189.100.103]) by above.proper.com (8.11.6/8.11.3) with ESMTP id fBBHY5203532 for ; Tue, 11 Dec 2001 09:34:05 -0800 (PST) Received: [from pobox2.mot.com (pobox2.mot.com [136.182.15.8]) by motgate3.mot.com (motgate3 2.1) with ESMTP id KAA13719 for ; Tue, 11 Dec 2001 10:24:20 -0700 (MST)] Received: [from m-il06-r1.mot.com (m-il06-r1.mot.com [129.188.137.193]) by pobox2.mot.com (MOT-pobox2 2.0) with ESMTP id KAA14264 for ; Tue, 11 Dec 2001 10:33:56 -0700 (MST)] Received: from thorgal.crm.mot.com by m-il06-r1.mot.com with ESMTP for ietf-ipsra@vpnc.org; Tue, 11 Dec 2001 10:33:55 -0700 Received: from crm.mot.com (nero.crm.mot.com [140.101.173.36]) by thorgal.crm.mot.com (Postfix) with ESMTP id C29352EC83; Tue, 11 Dec 2001 18:32:56 +0100 (CET) Message-Id: <3C164370.FAC89A69@crm.mot.com> Date: Tue, 11 Dec 2001 18:33:36 +0100 From: Alexis Olivereau Reply-To: Alexis Organization: Centre de Recherche de Motorola - Paris X-Mailer: Mozilla 4.7 [en] (WinNT; I) X-Accept-Language: en MIME-Version: 1.0 To: ietf-ipsra@vpnc.org Subject: IPSRA and Mobile IP Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-ietf-ipsra@mail.vpnc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: Content-Transfer-Encoding: 7bit Hello all, I have seen in the WG description that one of the goals of IPSRA WG is to work closely with Mobile IP WG. I have (briefly) looked through the ML archive but I wasn't able to find something relative to that topic... Is there any achieved, ongoing or planned work to develop a Mobile-IP-aware secure remote access solution? Many thanks in advance! Best regards, Alexis. PS. Please reply to my address directly since I have not (yet) subscribed to the mailing list. From owner-ietf-ipsra@mail.vpnc.org Tue Dec 11 14:28:18 2001 Received: from above.proper.com (above.proper.com [208.184.76.39]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA23491 for ; Tue, 11 Dec 2001 14:28:18 -0500 (EST) Received: from localhost (localhost [[UNIX: localhost]]) by above.proper.com (8.11.6/8.11.3) id fBBIdxx07303 for ietf-ipsra-bks; Tue, 11 Dec 2001 10:39:59 -0800 (PST) Received: from htt-consult.com (homebase.htt-consult.com [65.84.78.210]) by above.proper.com (8.11.6/8.11.3) with SMTP id fBBIds207299 for ; Tue, 11 Dec 2001 10:39:58 -0800 (PST) Received: from portege3490.htt-consult.com ([65.84.78.214]) by htt-consult.com ; Tue, 11 Dec 2001 13:39:54 -0500 Message-Id: <5.1.0.14.2.20011211133213.01fb5d28@localhost> X-Sender: rgm-sec@localhost X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Tue, 11 Dec 2001 13:39:33 -0700 To: ietf-ipsra@vpnc.org From: Robert Moskowitz Subject: PIC terminology Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Sender: owner-ietf-ipsra@mail.vpnc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: I have always been bothered by the PIC terminology: Authentication server (AS): a server at the organization which can relay the user's authentication request to the legacy system. Legacy authentication server (LAS): a RADIUS server, LDAP server and the like, which the AS uses to authenticate the user. My recent work in WLAN has shown me a different usage that might be of value here. I know that changing wording late in the game is hard, but perhaps it might give greater flexiblity. **************************** I have long time been bothered by the term: Legacy authentication server These things are NOT Legacy. I am going to recommend we use terms like 802.1x does. I fully realize the topological differences between PIC and 802.1x, but functionally they do very similar things. 802.1x has the terms: Authenticator and Authentication Server. The mapping is: PICS 802.1x AS Authenticator LAS Authentication Server Robert Moskowitz TruSecure Corporation Security Interest EMail: rgm-sec@htt-consult.com From owner-ietf-ipsra@mail.vpnc.org Tue Dec 11 15:44:26 2001 Received: from above.proper.com (above.proper.com [208.184.76.39]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA24567 for ; Tue, 11 Dec 2001 15:44:25 -0500 (EST) Received: from localhost (localhost [[UNIX: localhost]]) by above.proper.com (8.11.6/8.11.3) id fBBJdxG09624 for ietf-ipsra-bks; Tue, 11 Dec 2001 11:39:59 -0800 (PST) Received: from calliope1.fm.intel.com (fmfdns01.fm.intel.com [132.233.247.10]) by above.proper.com (8.11.6/8.11.3) with ESMTP id fBBJdv209620 for ; Tue, 11 Dec 2001 11:39:57 -0800 (PST) Received: from fmsmsxvs042.fm.intel.com (fmsmsxv042-1.fm.intel.com [132.233.48.110]) by calliope1.fm.intel.com (8.9.1a+p1/8.9.1/d: relay.m4,v 1.46 2001/10/25 21:02:55 root Exp $) with SMTP id TAA14080 for ; Tue, 11 Dec 2001 19:40:00 GMT Received: from orsmsx26.jf.intel.com ([192.168.65.26]) by fmsmsxvs042.fm.intel.com (NAVGW 2.5.1.16) with SMTP id M2001121111411626438 ; Tue, 11 Dec 2001 11:41:16 -0800 Received: by orsmsx26.jf.intel.com with Internet Mail Service (5.5.2653.19) id ; Tue, 11 Dec 2001 11:39:59 -0800 Message-ID: <0DCC27458EB5D51181840002A507069EE30BA0@orsmsx117.jf.intel.com> From: "Iyer, Prakash" To: "'Alexis'" , ietf-ipsra@vpnc.org Subject: RE: IPSRA and Mobile IP Date: Tue, 11 Dec 2001 11:39:51 -0800 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain; charset="ISO-8859-1" Sender: owner-ietf-ipsra@mail.vpnc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: We have a draft (draft-adrangi-mobileip-natvpn-traversal-00.txt) in the mobile IP working group that addresses the integration of an IPsec-based remote access VPN with mobile IPv4. -Prakash -----Original Message----- From: Alexis Olivereau [mailto:Alexis_Olivereau-AAO011@email.mot.com] Sent: Tuesday, December 11, 2001 9:34 AM To: ietf-ipsra@vpnc.org Subject: IPSRA and Mobile IP Hello all, I have seen in the WG description that one of the goals of IPSRA WG is to work closely with Mobile IP WG. I have (briefly) looked through the ML archive but I wasn't able to find something relative to that topic... Is there any achieved, ongoing or planned work to develop a Mobile-IP-aware secure remote access solution? Many thanks in advance! Best regards, Alexis. PS. Please reply to my address directly since I have not (yet) subscribed to the mailing list. From owner-ietf-ipsra@mail.vpnc.org Tue Dec 11 16:25:36 2001 Received: from above.proper.com (above.proper.com [208.184.76.39]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA25160 for ; Tue, 11 Dec 2001 16:25:35 -0500 (EST) Received: from localhost (localhost [[UNIX: localhost]]) by above.proper.com (8.11.6/8.11.3) id fBBKJuW12127 for ietf-ipsra-bks; Tue, 11 Dec 2001 12:19:56 -0800 (PST) Received: from zrc2s0jx.nortelnetworks.com (zrc2s0jx.nortelnetworks.com [47.103.122.112]) by above.proper.com (8.11.6/8.11.3) with ESMTP id fBBKJt212122 for ; Tue, 11 Dec 2001 12:19:55 -0800 (PST) Received: from zrchb200.us.nortel.com (zrchb200.us.nortel.com [47.103.121.45]) by zrc2s0jx.nortelnetworks.com (Switch-2.2.0/Switch-2.2.0) with ESMTP id fBBKJZw20825; Tue, 11 Dec 2001 14:19:35 -0600 (CST) Received: by zrchb200.us.nortel.com with Internet Mail Service (5.5.2653.19) id ; Tue, 11 Dec 2001 14:18:23 -0600 Message-ID: <933FADF5E673D411B8A30002A5608A0E01223E27@zrc2c012.us.nortel.com> From: "Glenn Morrow" To: "Iyer, Prakash" , "'Alexis'" , ietf-ipsra@vpnc.org Subject: RE: IPSRA and Mobile IP Date: Tue, 11 Dec 2001 14:18:39 -0600 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C18281.055FEFD0" Sender: owner-ietf-ipsra@mail.vpnc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C18281.055FEFD0 Content-Type: text/plain; charset="iso-8859-1" The SEAMOBY group is also looking at Candidate Access Router discovery for seamless handoff. They will need to handle VPN's and possible handoff between disparate address spaces at some point as well. The tunneling/routing header discussions may be common in some cases, too. The needs of IPSRA and MIP with respect to longer term enhancements to IPSEC may also be similar. Separation of encryption equipment from the endpoints themselves is not speficied in MIPv6 right now but will certainly have architecural ramifications away from the current end to end model. It might be best synergized as part of local mobility management which allows for such a point to point or subnet to subnet gateway models. If I were you I would focus on the local mobility management aspects of the WG to find some initial synergy. Hope this helps, Glenn > -----Original Message----- > From: Iyer, Prakash [mailto:prakash.iyer@intel.com] > Sent: Tuesday, December 11, 2001 1:40 PM > To: 'Alexis'; ietf-ipsra@vpnc.org > Subject: RE: IPSRA and Mobile IP > > > > > We have a draft > (draft-adrangi-mobileip-natvpn-traversal-00.txt) in the > mobile IP working group > that addresses the integration of an IPsec-based remote > access VPN with > mobile IPv4. > -Prakash > > -----Original Message----- > From: Alexis Olivereau [mailto:Alexis_Olivereau-AAO011@email.mot.com] > Sent: Tuesday, December 11, 2001 9:34 AM > To: ietf-ipsra@vpnc.org > Subject: IPSRA and Mobile IP > > > > Hello all, > > I have seen in the WG description that one of the goals of IPSRA WG is > to work closely with Mobile IP WG. I have (briefly) looked > through the > ML archive but I wasn't able to find something relative to > that topic... > Is there any achieved, ongoing or planned work to develop a > Mobile-IP-aware secure remote access solution? > > Many thanks in advance! > Best regards, > Alexis. > > > PS. Please reply to my address directly since I have not (yet) > subscribed to the mailing list. > ------_=_NextPart_001_01C18281.055FEFD0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable RE: IPSRA and Mobile IP

The SEAMOBY group is also looking at Candidate Access = Router discovery for seamless handoff. They will need to handle VPN's = and possible handoff between disparate address spaces at some point as = well.

The tunneling/routing header discussions may be = common in some cases, too.

The needs of IPSRA and MIP with respect to longer = term enhancements to IPSEC may also be similar.

Separation of encryption equipment from the endpoints = themselves is not speficied in MIPv6 right now but will certainly have = architecural ramifications away from the current end to end model. It = might be best synergized as part of local mobility management which = allows for such a point to point or subnet to subnet gateway = models.

 If I were you I would focus on the local = mobility management aspects of the WG to find some initial = synergy.

Hope this helps,

Glenn

> -----Original Message-----
> From: Iyer, Prakash [mailto:prakash.iyer@intel.com= ]
> Sent: Tuesday, December 11, 2001 1:40 PM
> To: 'Alexis'; ietf-ipsra@vpnc.org
> Subject: RE: IPSRA and Mobile IP
>
>
>
>
> We have a draft
> = (draft-adrangi-mobileip-natvpn-traversal-00.txt) in the
> mobile IP working group
> that addresses the integration of an = IPsec-based remote
> access VPN with
> mobile IPv4.
> -Prakash
>
> -----Original Message-----
> From: Alexis Olivereau [mailto:Alexis_Oliv= ereau-AAO011@email.mot.com]
> Sent: Tuesday, December 11, 2001 9:34 AM
> To: ietf-ipsra@vpnc.org
> Subject: IPSRA and Mobile IP
>
>
>
> Hello all,
>
> I have seen in the WG description that one of = the goals of IPSRA WG is
> to work closely with Mobile IP WG.  I have = (briefly) looked
> through the
> ML archive but I wasn't able to find something = relative to
> that topic...
> Is there any achieved, ongoing or planned work = to develop a
> Mobile-IP-aware secure remote access = solution?
>
> Many thanks in advance!
> Best regards,
> Alexis.
>
>
> PS. Please reply to my address directly since I = have not (yet)
> subscribed to the mailing list.
>

------_=_NextPart_001_01C18281.055FEFD0-- From owner-ietf-ipsra@mail.vpnc.org Tue Dec 11 18:07:32 2001 Received: from above.proper.com (above.proper.com [208.184.76.39]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA27100 for ; Tue, 11 Dec 2001 18:07:32 -0500 (EST) Received: from localhost (localhost [[UNIX: localhost]]) by above.proper.com (8.11.6/8.11.3) id fBBM8p519305 for ietf-ipsra-bks; Tue, 11 Dec 2001 14:08:51 -0800 (PST) Received: from mail2.microsoft.com (mail2.microsoft.com [131.107.3.124]) by above.proper.com (8.11.6/8.11.3) with ESMTP id fBBM8n219300 for ; Tue, 11 Dec 2001 14:08:49 -0800 (PST) Received: from INET-VRS-02.redmond.corp.microsoft.com ([157.54.8.110]) by mail2.microsoft.com with Microsoft SMTPSVC(5.0.2195.2966); Tue, 11 Dec 2001 14:08:47 -0800 Received: from 157.54.8.109 by INET-VRS-02.redmond.corp.microsoft.com (InterScan E-Mail VirusWall NT); Tue, 11 Dec 2001 14:08:46 -0800 Received: from red-imc-02.redmond.corp.microsoft.com ([157.54.9.107]) by inet-hub-02.redmond.corp.microsoft.com with Microsoft SMTPSVC(5.0.2195.2966); Tue, 11 Dec 2001 14:08:46 -0800 Received: from win-imc-02.wingroup.windeploy.ntdev.microsoft.com ([157.54.0.84]) by red-imc-02.redmond.corp.microsoft.com with Microsoft SMTPSVC(5.0.2195.2966); Tue, 11 Dec 2001 14:08:45 -0800 Received: from win-msg-01.wingroup.windeploy.ntdev.microsoft.com ([157.54.0.52]) by win-imc-02.wingroup.windeploy.ntdev.microsoft.com with Microsoft SMTPSVC(6.0.3588.0); Tue, 11 Dec 2001 14:07:17 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.0.6092.0 Content-Class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Subject: RE: I-D ACTION:draft-ietf-ipsra-reqmts-04.txt Date: Tue, 11 Dec 2001 14:07:17 -0800 Message-ID: <2E33960095B58E40A4D3345AB9F65EC1045451D8@win-msg-01.wingroup.windeploy.ntdev.microsoft.com> Thread-Topic: I-D ACTION:draft-ietf-ipsra-reqmts-04.txt Thread-Index: AcEwrzBACsEXVORuS3SoOM1l8HSpzxR3r/lw From: "William Dixon" To: Cc: X-OriginalArrivalTime: 11 Dec 2001 22:07:17.0566 (UTC) FILETIME=[3267F5E0:01C18290] Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by above.proper.com id fBBM8n219301 Sender: owner-ietf-ipsra@mail.vpnc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: Content-Transfer-Encoding: 8bit L2TP group, per my comments in the WG meeting today, since the L2TP/IPSec integration document has become RFC 3193, please review this IPSec Secure Remote Access requirements document. http://www.ietf.org/rfc/rfc3193.txt?number=3193 -----Original Message----- From: Internet-Drafts@ietf.org [mailto:Internet-Drafts@ietf.org] Sent: Wednesday, August 29, 2001 4:20 AM Cc: ietf-ipsra@vpnc.org Subject: I-D ACTION:draft-ietf-ipsra-reqmts-04.txt A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the IP Security Remote Access Working Group of the IETF. Title : Requirements for IPsec Remote Access Scenarios Author(s) : S. Kelly, S. Ramamoorthi Filename : draft-ietf-ipsra-reqmts-04.txt Pages : 33 Date : 28-Aug-01 IPsec offers much promise as a secure remote access mechanism. However, there are a significant number of remote access scenarios, each having some shared and some unique requirements. A thorough understanding of these requirements is necessary in order to effectively evaluate the suitability of a specific set of mechanisms for any particular remote access scenario. This document enumerates the requirements for a number of common remote access scenarios. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-ipsra-reqmts-04.txt Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-ipsra-reqmts-04.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-ipsra-reqmts-04.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft.