Subject: RE: [Dime] Re: Reg. the IPSEC Usage section.

From: "Soji VP" <[email-masked]>
Date: Tue, 10 Jul 2007 20:14:12 +0530

Hi Victor,

Its ok, but need one more clarification. Are we assuming default support
of IpSec by a node?. i.e if node A support both TLS and IPSec and it set
value of inband-security-id to "TLS" in CER to its peer node B. But node
B supports only IPSec and should it send CEA with result code
DIAMETER_NO_COMMON_SECURITY and disconnect the connection (As per
section 5.3)? or should it send CEA with NO_INBAND_SECURITY for
inband-security-id AVP? So what's action node A ideally should be
taking? Considering the fact that, they can still continue transaction
further as both of them support IPSec.

Thanks 
-Soj

-----Original Message-----
From: Victor Fajardo [mailto:[email-masked]] 
Sent: Tuesday, July 10, 2007 7:25 PM
To: Soji VP
Cc: [email-masked]
Subject: Re: [Dime] Re: Reg. the IPSEC Usage section.

Hi Soji,
> I've a follow-up question on this. Consider a scenario where node A
and
> node B is trying to exchange CER/A and both of them doesn't support
TLS.
> Node A support IpSec but node B doesn't. 
> In this case, what would be the inband-security-id avp in CER/A? 
>
> Again, what would be the inband-security-id AVP in CER/A if both of
them
> support IpSec?
>
> Can I assume NO_INBAND_SECURITY only if both of them doesn't support
TLS
> and IPSec? 

You can check-out sec 13 of bis-05. Let me know if the text is still 
unclear.

-- victor

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime

---

From: Victor Fajardo <[email-masked]>
Date: Tue, 10 Jul 2007 10:59:01 -0400

Comments inline:
> of IpSec by a node?.

I think the idea of simplifying the spec is so that the protocol 
internals does not interact with IPsec. Hence, inband security deals 
only with TLS and is oblivious to IPsec. I think a diameter 
implementation should not force itself on trying to represent IPsec 
anywhere. IPsec is more of a deployment policy.

> i.e if node A support both TLS and IPSec and it set
> section 5.3)?

Yes.

> or should it send CEA with NO_INBAND_SECURITY for
> inband-security-id AVP? 

Since 5.3 already defines a behavior then we should not assume this.

hope this helps,
victor