Subject: [Ipsec] draft-eronen-ipsec-ikev2-ipv6-config

From: <[email-masked]>
Date: Thu, 14 Jun 2007 14:40:25 +0300

Hi folks,

Paul already forwarded the I-D announcement here, but here's
again a link to a new draft you may find interesting.

http://www.ietf.org/internet-drafts/draft-eronen-ipsec-ikev2-ipv6-config
-00.txt

Any comments you may have are most welcome!

Probably the most important decision is what kind(s) of link
model(s) we assume for the virtual link. For simplicity, the
current draft considers only the "point-to-point" link model 
(where each VPN client gets a different prefix). This may 
come as a surprise to some folks who've accustomed to IPv4 
way of doing things... but it's also what e.g 3G mobile phones 
do (each phone gets a unique /64 prefix).

But maybe this is too different from what VPN vendors and
administrators are used to? Sharing a single /64 between all 
VPN clients may be feasible as well, but there are lot of
complications with address assignment. A host cannot just start
using an Interface ID (for e.g. CGA or HBA): we need to ensure 
the same ID isn't used by someone else, and some "forwarding 
state" in the VPN gateway has to be updated.

Most likely this would have to be done with IKE messages (rather
than NS/NA), since NS/NA would require either a "multi-access-like" 
link model (where link-local multicast is forwarded to other VPN 
clients sharing the prefix) or spoofing NS/NA by the VPN gateway... 
and updating forwarding state based on NS/NA would be a bit ugly 
anyway.

Any thoughts about this?

Best regards,
Pasi

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec