Subject: [IPsec] FW: [ipsecme] #211: We should talk more about why this is a hard problem.

From: Stephen Hanna <[email-masked]>
Date: Tue, 20 Mar 2012 21:26:57 -0400

Second issue. Please comment on the suggested resolution.

Thanks,

Steve

-----Original Message-----
From: ipsecme issue tracker [mailto:[email-masked]] 
Sent: Tuesday, March 20, 2012 6:49 PM
To: [email-masked]; [email-masked]
Subject: [ipsecme] #211: We should talk more about why this is a hard problem.

#211: We should talk more about why this is a hard problem.

 This topic came up several times in different ways: we should talk about
 gaps, we should say more clearly why this is hard, etc.

 Suggested Resolution: Add a Requirements section that lays out the hard
 (or not so hard) problems that any solution must address.

-- 
-------------------------+-------------------------------------------------
 Reporter:               |      Owner:  draft-ietf-ipsecme-p2p-vpn-
  yaronf.ietf@…          |  problem@…
     Type:  defect       |     Status:  new
 Priority:  normal       |  Milestone:
Component:  p2p-vpn-     |   Severity:  -
  problem                |
 Keywords:               |
-------------------------+-------------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/ipsecme/trac/ticket/211>
ipsecme <http://tools.ietf.org/ipsecme/>

---

From: yogendra pal <[email-masked]>
Date: Wed, 21 Mar 2012 21:23:02 +0530

1. Let us not say this is a hard problem, it sounds like NP hard problem
(which indeed it's not)
Just rephrasing it, Suggested Resolution: Add a Requirements section that
lays out the problems that any solution must address.

>"#211: We should talk more about why this is a hard problem."
>

>(or not so hard) problems that any solution must address.

Thanks and Regards,
Yogendra Pal
Ericsson, India
+919686202644

On Wed, Mar 21, 2012 at 6:56 AM, Stephen Hanna <[email-masked]> wrote:

> To: [email-masked];
> [email-masked]
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec
>

--

---

From: Michael Richardson <[email-masked]>
Date: Mon, 26 Mar 2012 10:12:17 +0200

I agree: it's not a "hard problem". It's an annoying problem, and the
lack of a dynamic solution causes poor experiences for users.

For a relatively static group of non-moving leaf gateways, even a very
large group, a bit of scripting could generate most of the full mesh
policy, and normal IKEv2 on-demand keying of links would bring up
tunnels as needed.

The reason to have an automatic system is because:
    1) we have mobile nodes that we want to include (roadwarriors)

    2) we have gateways behind NAT that can be hard to find.

    3) we have machines/gateways that have non-transtive authentication
       mechanisms, and it would be very annoying to setup each leaf
       system with a trusted connection to the AAA system for
       authentication.

-- 
]       He who is tired of Weird Al is tired of life!           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
   Kyoto Plus: watch the video <http://www.youtube.com/watch?v=kzx1ycLXQSE>
	               then sign the petition.

---

From: Vishwas Manral <[email-masked]>
Date: Mon, 26 Mar 2012 04:15:56 -0700

I agree.

-Vishwas