Subject: RE: [AAA-WG]: Question on the use of IPSEC with Diameter

From: <[email-masked]>
Date: Wed, 4 Feb 2004 12:04:55 +0200

Hi Jari & James,

> Strictly speaking, I don't think it is required that Diameter is aware
> of IPsec. However, the usage of IPsec is less flexible than TLS where
> such awareness is easily available, and this can cause issues in the
> configuration of suitable CAs and the simultaneous usage of TLS and
> IPsec. In short, the independent host and application implementation
> is conformant, but may not offer quite the same ease and flexibility
> compared to the sole use of TLS or the ability of the application to be
> aware of IPsec.

Just to add to Jari's comment.  Diameter by itself is (for the most part)
IPsec unaware, building AAA infrastructure is not.  As shown in figure 1,
in section 2.5:

http://www.ietf.org/rfc/rfc3588.txt

There are multiple parts of the communication session between Diameter 
clients and servers.  Therefore special care needs to be made when
including IPsec or TLS.  Jari's text covered this issue well.

thanks,
John