Subject: [IPsec] IPsecME virtual interim meeting

From: Yaron Sheffer <[email-masked]>
Date: Sat, 27 Apr 2013 20:02:08 +0300

Dear IPsec folks,

The ipsecme working group is chartered to come up with a solution for 
transporting long IKEv2 messages over networks that do not perform IP 
fragmentation correctly, and as a result drop overly long messages, 
usually IKE_AUTH messages.

Our original plan was to base the solution on IKE-over-TCP, however the 
author of this draft decided to abandon it because he now prefers a 
different solution, similar to the (non-standard) IKEv1 Fragmentation 
payload that was implemented by several vendors (see 
http://msdn.microsoft.com/en-us/library/cc233251.aspx). We do not want 
to end up with a common but non-standard solution in IKEv2, which would 
practically guarantee interoperability issues.

As a further data point, we are aware of IPR issues with Microsoft's 
solution; we have tried to clarify the issue with Microsoft but have not 
been successful yet.

We would like to invite the group to a Virtual Interim Meeting (a.k.a. 
conference call), to discuss this problem.

Potential outcomes of the meeting include:
- The group decides that this is not an important problem.
- This is an important problem and we have 1-2 people committed to 
author a draft along the lines of the non-standard IKEv1 mechanism.
- This is an important problem and the group is happy to adopt 
draft-smyslov-ipsecme-ikev2-fragmentation (which solves the same problem 
in a somewhat different fashion).
- The group still prefers IKE-over-TCP and there are committed authors 
to continue work on that draft.

We propose to meet May 7, at 9:00am PST (16:00 UTC, 12:00 noon EST, 
19:00 Israel) for 1 hour. We will publish a bridge number a week before 
the meeting.

Please let us know if the date/time absolutely doesn't work for you.

We welcome and invite discussion of these issues on the mailing list 
before the meeting.

Thanks,
     Paul and Yaron

---

From: Michael Richardson <[email-masked]>
Date: Sat, 27 Apr 2013 20:17:57 -0400

>>>>> "Yaron" == Yaron Sheffer <[email-masked]> writes:
    Yaron> We propose to meet May 7, at 9:00am PST (16:00 UTC, 12:00 noon EST, 19:00
    Yaron> Israel) for 1 hour. We will publish a bridge number a week
    Yaron> before the meeting. 

okay.
Is that enough notice?

I agree that the problem likely needs be solved in a standard way.

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

---

From: Yoav Nir <[email-masked]>
Date: Sun, 28 Apr 2013 06:55:47 +0000

On Apr 27, 2013, at 8:02 PM, Yaron Sheffer <[email-masked]> wrote:

> Dear IPsec folks,
> 
> The ipsecme working group is chartered to come up with a solution for transporting long IKEv2 messages over networks that do not perform IP fragmentation correctly, and as a result drop overly long messages, usually IKE_AUTH messages.
> 
> Our original plan was to base the solution on IKE-over-TCP, however the author of this draft decided to abandon it because he now prefers a different solution, similar to the (non-standard) IKEv1 Fragmentation payload that was implemented by several vendors (see http://msdn.microsoft.com/en-us/library/cc233251.aspx). We do not want to end up with a common but non-standard solution in IKEv2, which would practically guarantee interoperability issues.

Just to set the record straight, I did not decide to abandon it, and if the group would like to pursue IKE-over-TCP I am willing to continue as editor. As a vendor, though, I would much rather implement just one mechanism that would work for both IKEv1 and IKEv2, and there is a huge installed base of IKEv1 with fragments.

 <snip/>

> We propose to meet May 7, at 9:00am PST (16:00 UTC, 12:00 noon EST, 19:00 Israel) for 1 hour. We will publish a bridge number a week before the meeting.
> 

This works for me.

Yoav

---

From: Yaron Sheffer <[email-masked]>
Date: Sun, 28 Apr 2013 10:20:16 +0300

Hi Michael,

formally yes, we only need 2 weeks' notice for a conference call: 
http://www.ietf.org/iesg/statement/interim-meetings.html

But the date is not (yet) set in stone. Let us know if you cannot attend 
for any reason.

Thanks,
	Yaron

---

From: Hannes Tschofenig <[email-masked]>
Date: Sun, 28 Apr 2013 12:07:58 +0300

Hi Yaron,

The issue is that it has to be announcement by the IESG secretary 2 
weeks in advance.

End of last year I suggested to simplify the rules for virtual interim 
meetings but my proposal was not well received, see
http://list-archives.org/2012/12/03/ietf-ietf-org/simplifying-our-processes-conference-calls/f/1357342837

For some people it seems very important that the call conference call is 
announced on the IETF announcement list. It appears that there are 
people who are not on the working group mailing lists but would like to 
participate in conference calls.

For that reason just announcing it on the mailing list does not count.

Ciao
Hannes

On 04/28/2013 10:20 AM, Yaron Sheffer wrote:
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec

---

From: Yaron Sheffer <[email-masked]>
Date: Sun, 28 Apr 2013 12:26:20 +0300

It's much simpler than that: I'm fine with the process, I just got my 
numbers wrong (blush). May 7 is less than 2 weeks in the future.

Instead, I'd like to propose Thursday, May 16, same time. Any objections?

Thanks,
	Yaron