Subject: [IPsec] P2P VPN draft

From: Yaron Sheffer <[email-masked]>
Date: Wed, 07 Mar 2012 23:17:59 +0200

Hi Steve,

a few initial comments.

  * The draft is short and clear. Thanks for that!
  * I have a problem with the title (and even more, with the "file name"
    of the draft). P2P is usually perceived as peer-to-peer, which skews
    the discussion towards one particular use case, that of
    endpoint-to-endpoint. I suggest to use "Mesh IPsec VPN" instead.
  * I am unclear about 2.2: so what if you "suddenly need to exchange a
    lot of data". How is it different from normal IP traffic load
    management? The text is simply too vague here. Ideally, should we
    expect the traffic to migrate to other gateways? To go directly
    between endpoints? To establish priorities on existing gateways?

Thanks,

     Yaron

---

From: "Ulliott, Chris" <[email-masked]>
Date: Wed, 7 Mar 2012 21:52:37 +0000

Classification:UNCLASSIFIED

How about "dynamic mesh VPNs" as a title as I think the dynamic part is key here and probably an important aspect of the use cases.

Chris

[This message has been sent by a mobile device]

----- Original Message -----
From: Yaron Sheffer [mailto:[email-masked]]
Sent: Wednesday, March 07, 2012 09:17 PM
To: IPsecme WG <[email-masked]>
Subject: [IPsec] P2P VPN draft

Hi Steve,

a few initial comments.

Thanks,

     Yaron

_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

****************************************************************************
Communications with GCHQ may be monitored and/or recorded 
for system efficiency and other lawful purposes. Any views or 
opinions expressed in this e-mail do not necessarily reflect GCHQ 
policy.  This email, and any attachments, is intended for the 
attention of the addressee(s) only. Its unauthorised use, 
disclosure, storage or copying is not permitted.  If you are not the
intended recipient, please notify [email-masked].  

This information is exempt from disclosure under the Freedom of 
Information Act 2000 and may be subject to exemption under
other UK information legislation. Refer disclosure requests to 
GCHQ on 01242 221491 ext 30306 (non-secure) or email
[email-masked]

****************************************************************************

The original of this email was scanned for viruses by the Government Secure Intranet virus scanning service supplied by Cable&Wireless Worldwide in partnership with MessageLabs. (CCTM Certificate Number 2009/09/0052.) On leaving the GSi this email was certified virus free.
Communications via the GSi may be automatically logged, monitored and/or recorded for legal purposes.

---

From: Yaron Sheffer <[email-masked]>
Date: Thu, 08 Mar 2012 00:30:20 +0200

Fine with me.

	Yaron

On 03/07/2012 11:52 PM, Ulliott, Chris wrote:
> To: IPsecme WG<[email-masked]>

---

From: Stephen Hanna <[email-masked]>
Date: Wed, 7 Mar 2012 17:51:51 -0500

Upon reflection, I can see how "Point to Point VPNs" is problematic
as a description of the problem. Really it's more about dynamically
creating SAs so that any endpoint or gateway can communicate directly
with any other, as permitted by policy. And how can we do this in a
manageable manner in a large-scale environment where endpoints are
mobile and configurations and policies change often?

So "Dynamic Mesh VPNs" is fine with me. Whatever the WG feels is best.

Thanks,

Steve

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Ulliott, Chris
> Sent: Wednesday, March 07, 2012 4:53 PM
> To: [email-masked]'
> Subject: Re: [IPsec] P2P VPN draft UNCLASSIFIED
> 
> How about "dynamic mesh VPNs" as a title as I think the dynamic part is
> key here and probably an important aspect of the use cases.
> 
> Chris
> 
> The original of this email was scanned for viruses by the Government
> Secure Intranet virus scanning service supplied by Cable&Wireless
> Worldwide in partnership with MessageLabs. (CCTM Certificate Number
> 2009/09/0052.) On leaving the GSi this email was certified virus free.

---

From: jorge coronel <[email-masked]>
Date: Wed, 7 Mar 2012 17:09:44 -0800

Yes, that is fine. Although one could argue that the 1st Use case is P2P in its nature; as only some signaling would need to traverse an actual VPN tunnel and the connection between the 2 clients would be P2P.Should we add a standard Gaps section, where we don't necessarily list the requirements but start building a list of gaps that will help clarify the problem statement:It seems that we at least have a partial list already, like:- Dynamic discovery/configuration- Optimal path for high performance.- Ability to select the closest entry point. ThanksJC> From: [email-masked]
> To: [email-masked]; [email-masked]
> Date: Wed, 7 Mar 2012 17:51:51 -0500

---

From: Yoav Nir <[email-masked]>
Date: Thu, 8 Mar 2012 09:08:59 +0200

I like it.

On Mar 7, 2012, at 11:52 PM, Ulliott, Chris wrote:

> Scanned by Check Point Total Security Gateway.