Subject: Re: Non-IP Protocol Support

From: "West, Mark" <[email-masked]>
Date: Thu, 4 Aug 2005 11:40:43 +0100

A further comment on Juan's point (and something that came up in
discussion after the ipdvb session, yesterday)...

If there is a security mechanism for IP (e.g. IPsec) and you want to apply
that to non-IP flows (e.g. a stream of SNDUs, Ethernet frames, ...) then
why not run the non-IP over an emulated pseudo-wire within the IPsec
tunnel?  Then you only need an IP-based security solution.

I honestly don't know whether this is appropriate, but it seemed like an
interesting idea at the time!

(http://www.ietf.org/internet-drafts/draft-ietf-pwe3-iana-allocation-11.txt
already has codepoints for Ethernet, etc., but not anything specific to
the ipdvb case.)

Cheers,

Mark.

--
Mark A. West, Senior Consultant Engineer
Roke Manor Research Ltd., Romsey, Hants.  SO51 0ZN
Phone +44 (0)1794 833311   Fax  +44 (0)1794 833433

---

From: Gorry Fairhurst <[email-masked]>
Date: Thu, 04 Aug 2005 12:35:19 +0200

The IETF have defined several foo-over-IP methods which could be used, and
these should work with ULE (bidirectional IP connectivity may be required).
PWE3 is by no means the only option.

However, there are situations were this tunnel over IP approach really does
not do what may be wanted. ARP for IPv4 is a classic example. If you wanted
to use arp to resolve an IP to MAC address, then clearly you can't
encapsulate this over IP to send it.

Gorry