Subject: [IPsec] Comments on proposed draft-ietf-ipsecme-ad-vpn-problem-02

From: Brian Weis <[email-masked]>
Date: Tue, 11 Dec 2012 12:30:56 -0800

Hi Steve & Vishwas,

Here are a couple of comments on the proposed -02 sent a few days ago.

Requirement 1 says "gateways and endpoints MUST minimize configuration changes when a new gateway or endpoint is added, removed or changed." While I certainly agree with the sentiment behind the requirement, this statement is about as strong as "gateways and endpoints MUST perform well", or "gateways and endpoints MUST be easy to use". In other words, it isn't a testable assertion that can be evaluated. Also the body of the document says "it is desired that there be minimal configuration on each gateway", which does not support a MUST requirement. This ought to be a SHOULD rather than a MUST.

Requirement 8 has gone through several versions, but I think it could still be made clearer. It first requires Gateways and endpoints "to work when they are behind NAT boxes", and then makes a bunch of necessary exceptions. The following replacement text attempts to make the same points as the original but might be clearer:

   8.  Gateways and endpoints MUST have the capability to participate 
   in an AD VPN even when they are located behind NAT boxes. However, 
   in some cases they may be deployed in such a way that they will not be 
   fully reachable behind a NAT box.  It is especially difficult 
   to handle cases where the Hub is behind a NAT box.  Where the
   two endpoints are both behind separate NATs, communication between
   these spokes SHOULD be supported using workarounds
   such as port forwarding by the NAT or detecting when two spokes
   are behind uncooperative NATs and using a hub in that case. 

Requirement 14 says "The ADVPN solution MUST support Provider Edge (PE) based VPN's". This requirement seems unfair to the end point use cases in 2.1 and 2.3, or even gateway-to-gateway ADVPN solutions that have nothing to do with L3VPNs! I think you're trying to say it must be possible to build an ADVPN solution that meets the requirements of L3VPN, which I have no problem with but I don't think think this it's a fair requirement to put in Section 4. Is there anything beyond the new text you added in 2.2 regarding L3VPN that needs to be said?

There's a couple remaining nits:

Section 2.2: s/A fully meshed solution is would/A fully meshed solution would/
Section 4: s/This sectiondefines/This section defines/

Thanks,
Brian

---

From: Vishwas Manral <[email-masked]>
Date: Thu, 13 Dec 2012 09:54:09 -0800

Hi Brian,

Thanks a lot for your comments and sorry I did not reply immediately. I
have still been waiting for the version 2 to upload. I have sent it to the
[email-masked] address.

My comments are inline and will be updated in version 03. We could do it in
version 02 too if it does not get posted soon enough. The only issue I have
is with the L3VPN comment and would want Lou Berger's opinion on it, as he
thought the text would add value there (though if you see previous comments
I am more of the opinion similar to yours).

On Tue, Dec 11, 2012 at 12:30 PM, Brian Weis <[email-masked]> wrote:

> Requirement 1 says "gateways and endpoints MUST minimize configuration
> changes when a new gateway or endpoint is added, removed or changed." While
> I certainly agree with the sentiment behind the requirement, this statement
> is about as strong as "gateways and endpoints MUST perform well", or
> "gateways and endpoints MUST be easy to use". In other words, it isn't a
> testable assertion that can be evaluated. Also the body of the document
> says "it is desired that there be minimal configuration on each gateway",
> which does not support a MUST requirement. This ought to be a SHOULD rather
> than a MUST.
>
Changed the MUST to a SHOULD.

> Requirement 8 has gone through several versions, but I think it could
> still be made clearer. It first requires Gateways and endpoints "to work
> when they are behind NAT boxes", and then makes a bunch of necessary
> exceptions. The following replacement text attempts to make the same points
> as the original but might be clearer:
>
VM> Updated.

>
> Requirement 14 says "The ADVPN solution MUST support Provider Edge (PE)
> based VPN's". This requirement seems unfair to the end point use cases in
> 2.1 and 2.3, or even gateway-to-gateway ADVPN solutions that have nothing
> to do with L3VPNs! I think you're trying to say it must be possible to
> build an ADVPN solution that meets the requirements of L3VPN, which I have
> no problem with but I don't think think this it's a fair requirement to put
> in Section 4. Is there anything beyond the new text you added in 2.2
> regarding L3VPN that needs to be said?
>
VM> No I did not add any extra text for L3VPN besides this one. The idea
was that if IPsec over GRE as PE to PE communication tunnels the ADVPN
technology should not preclude such a solution.Like I have said earlier I
do not have strong opinion regarding this requirement. Lou thought this
should be there and I asked the list if there were objections to this, and
I did not hear anyone object, so I added it.

Lets try to hear from Lou on this.

> Section 4: s/This sectiondefines/This section defines/
VM> Updated.

Thanks,
Vishwas

>
> Thanks,
> Brian
>
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec
>

---

From: Brian Weis <[email-masked]>
Date: Thu, 13 Dec 2012 13:48:06 -0800

Hi Vishwas,

See a couple of notes inline.

On Dec 13, 2012, at 9:54 AM, Vishwas Manral <[email-masked]> wrote:

> Hi Brian,
> 
> Thanks a lot for your comments and sorry I did not reply immediately. I have still been waiting for the version 2 to upload. I have sent it to the [email-masked] address.
> 
> My comments are inline and will be updated in version 03. We could do it in version 02 too if it does not get posted soon enough.

Updating version 03 is fine with me. I was a bit late with the comments.

> The only issue I have is with the L3VPN comment and would want Lou Berger's opinion on it, as he thought the text would add value there (though if you see previous comments I am more of the opinion similar to yours).
> 
> VM> No I did not add any extra text for L3VPN besides this one. The idea was that if IPsec over GRE as PE to PE communication tunnels the ADVPN technology should not preclude such a solution.Like I have said earlier I do not have strong opinion regarding this requirement. Lou thought this should be there and I asked the list if there were objections to this, and I did not hear anyone object, so I added it.
>  

Thanks for the background. It should be possible to address Lou's concern underlying  concern without adding a requirement that is onerous for ADVPN use cases where L3VPN doesn't apply. The Section 2.2 text I referred to is "There is also the case when L3VPNs operate over IPsec Tunnels." Maybe that could be expanded into a new paragraph in lieu of a requirement? I notice the use of lower case "must" is used in this section. 

> Lets try to hear from Lou on this.

Lou, would something like the following text in Section 2.2 be a satisfactory replacement for Requirement 14?

    There is also the case when L3VPNs operate over IPsec Tunnels, 
    for example Provider Edge (PE) based VPN's. An AD VPN must
    support L3VPN as an application protected by the IPsec
    Tunnels.

Thanks,
Brian

---

From: Lou Berger <[email-masked]>
Date: Thu, 13 Dec 2012 17:00:16 -0500

Vishwas / Brian,
	See below

On 12/13/2012 12:54 PM, Vishwas Manral wrote:
> have still been waiting for the version 2 to upload. I have sent it to
> the [email-masked] <mailto:[email-masked]> address.
> 
> My comments are inline and will be updated in version 03. We could do it
> in version 02 too if it does not get posted soon enough. The only issue
> I have is with the L3VPN comment and would want Lou Berger's opinion on
> it, as he thought the text would add value there (though if you see
> previous comments I am more of the opinion similar to yours).
> 
> On Tue, Dec 11, 2012 at 12:30 PM, Brian Weis <[email-masked]
> <mailto:[email-masked]>> wrote:
> 
>     Hi Steve & Vishwas,
> 
...
>     Requirement 14 says "The ADVPN solution MUST support Provider Edge
>     (PE) based VPN's". This requirement seems unfair to the end point
>     use cases in 2.1 and 2.3, or even gateway-to-gateway ADVPN solutions
>     that have nothing to do with L3VPNs! 

Agreed, but the requirement is on the solution, not on a particular
implementation.

> I think you're trying to say it
>     must be possible to build an ADVPN solution that meets the
>     requirements of L3VPN, which I have no problem 

Yes, this was my basic point.

> with but I don't
>     think think this it's a fair requirement to put in Section 4.

I agree, it's not fair to have this as a specific implementation
requirement, but I think it's fair that this case must be supported by
the overall solution -- which is simply the previous point.

> Is
>     there anything beyond the new text you added in 2.2 regarding L3VPN
>     that needs to be said?
> 
> technology should not preclude such a solution.Like I have said earlier
> I do not have strong opinion regarding this requirement. Lou thought
> this should be there and I asked the list if there were objections to
> this, and I did not hear anyone object, so I added it.
>  
> ...

I think I've covered it above.

Much thanks,
Lou

---

From: Lou Berger <[email-masked]>
Date: Fri, 14 Dec 2012 13:15:00 -0500

Brian,
	Opps, should have replied to this message (and not the prior).

My previous mail basically said the new requirement is placed on the
ADVPN solution, not a particular implementation.  I think it's important
to ensure that the overall solution provides for Requirement 14, and I'm
not sure how this can be done without a requirement.

See below for additional specific responses.

On 12/13/2012 4:48 PM, Brian Weis wrote:
> On Dec 13, 2012, at 9:54 AM, Vishwas Manral <[email-masked]
> <mailto:[email-masked]>> wrote:
> 
>> Hi Brian,

...
>>     use cases in 2.1 and 2.3, or even gateway-to-gateway ADVPN
>>     solutions that have nothing to do with L3VPNs! I think you're
>>     trying to say it must be possible to build an ADVPN solution that
>>     meets the requirements of L3VPN, which I have no problem with but
>>     I don't think think this it's a fair requirement to put in Section
>>     4. Is there anything beyond the new text you added in 2.2
>> VM> No I did not add any extra text for L3VPN besides this one. The
>> idea was that if IPsec over GRE as PE to PE communication tunnels the
>> ADVPN technology should not preclude such a solution.Like I have said
>> earlier I do not have strong opinion regarding this requirement. Lou
>> thought this should be there and I asked the list if there were
>> objections to this, and I did not hear anyone object, so I added it.
>>  
> 
> Thanks for the background. It should be possible to address Lou's
> concern underlying  concern without adding a requirement that is onerous
> for ADVPN use cases where L3VPN doesn't apply. 

I agree there implementation cases where the requirement doesn't apply.
 This is why the requirement was phrased as being a requirement on the
overall solution, not on as an implementation requirement.

> The Section 2.2 text I
> referred to is "There is also the case when L3VPNs operate over IPsec
> Tunnels." Maybe that could be expanded into a new paragraph in lieu of a
> requirement? I notice the use of lower case "must" is used in this section. 
> 

> Lou, would something like the following text in Section 2.2 be a
> satisfactory replacement for Requirement 14?
> 

it he must was a MUST, sure.

Lou

>>     [email-masked] <mailto:[email-masked]>

---

From: Brian Weis <[email-masked]>
Date: Fri, 14 Dec 2012 13:56:22 -0800

Hi Lou,

> not sure how this can be done without a requirement.

If I understand correctly, these requirements are intending to be relevant to "ADVPN solutions" that don't include network infrastructure. It doesn't make sense to me to make a "ADVPN solution" implemented on PCs and comprised exclusively of PCs subject to this as a general requirement.

All other MUST requirements in Section 4 seem to apply equally to all use cases.

> See below for additional specific responses.

[snip]

> it he must was a MUST, sure.

I'd happily support a MUST here. There aren't any other MUSTs outside of Section 4, but I don't know why.

Thanks,
Brian

---

From: Vishwas Manral <[email-masked]>
Date: Fri, 14 Dec 2012 14:09:31 -0800

Hi Brian/ Lou,

So as a resolution for this, the only change required would be replacing
the requirement to:

There is also the case when L3VPNs operate over IPsec Tunnels, for example
Provider Edge (PE) based VPN's. An ADVPN MUST support L3VPN as an
application protected by the IPsec Tunnels.

I can do that now and post the new version of the draft across.

Thanks,
Vishwas
=====================================================
On Fri, Dec 14, 2012 at 1:56 PM, Brian Weis <[email-masked]> wrote:

> If I understand correctly, these requirements are intending to be relevant
> to "ADVPN solutions" that don't include network infrastructure. It doesn't
> make sense to me to make a "ADVPN solution" implemented on PCs and
> comprised exclusively of PCs subject to this as a general requirement.
>

---

From: Lou Berger <[email-masked]>
Date: Sun, 16 Dec 2012 12:11:34 -0500

Vishwas,
	This sounds reasonable to me.

Much thanks!

Lou

On 12/14/2012 5:09 PM, Vishwas Manral wrote:
> There is also the case when L3VPNs operate over IPsec Tunnels, for
> example Provider Edge (PE) based VPN's. An ADVPN MUST support L3VPN as
> an application protected by the IPsec Tunnels.
> 
> On Fri, Dec 14, 2012 at 1:56 PM, Brian Weis <[email-masked]
>     On Dec 14, 2012, at 10:15 AM, Lou Berger <[email-masked]
>     <mailto:[email-masked]>> wrote:
> 
>     > Brian,
>     If I understand correctly, these requirements are intending to be
>     relevant to "ADVPN solutions" that don't include network
>     infrastructure. It doesn't make sense to me to make a "ADVPN
>     solution" implemented on PCs and comprised exclusively of PCs
>     subject to this as a general requirement.
> 
>     I'd happily support a MUST here. There aren't any other MUSTs
>     outside of Section 4, but I don't know why.
> 
>     Thanks,
>     Brian
> 
>     >
>     > Lou
> 
> 
> 
>

---

From: Lou Berger <[email-masked]>
Date: Sun, 16 Dec 2012 12:12:46 -0500

Brian,
	Just want to confirm that Vishwas solution closes this issue.  Agreed?

Thanks,
Lou

---

From: Brian Weis <[email-masked]>
Date: Mon, 17 Dec 2012 10:43:55 -0800

> 	Just want to confirm that Vishwas solution closes this issue.  Agreed?

Agreed!

Thanks,
Brian

---

From: Vishwas Manral <[email-masked]>
Date: Mon, 17 Dec 2012 10:52:14 -0800

Perfect. I will send the udpated draft today.

-Vishwas

On Mon, Dec 17, 2012 at 10:43 AM, Brian Weis <[email-masked]> wrote:

> relevant to "ADVPN solutions" that don't include network infrastructure. It
> doesn't make sense to me to make a "ADVPN solution" implemented on PCs and

---

From: Lou Berger <[email-masked]>
Date: Mon, 17 Dec 2012 14:12:45 -0500

excellent.  Thank you both for resolving my comments so rapidly!

Lou