Subject: [IPsec] One comment to this draft//Fwd: I-D Action: draft-ietf-ipsecme-ad-vpn-problem-06.txt

From: Toby Mao <[email-masked]>
Date: Sat, 27 Apr 2013 11:10:37 +0800

I agree with almost all the requirements in the
draft-ietf-ipsecme-ad-vpn-problem. However, I think one more requirement
should be added in the Section 4.1.

The ADVPN solution SHOULD be able to implement Quality of Service (QoS) to
regulate the traffic in the ADVPN topology. ADVPN peer SHOULD NOT send
excessive traffic to the other members of ADVPN. The traffic for each ADVPN
peer CAN be measured individually for shaping and policing.

Best regards,
Toby

---------- Forwarded message ----------
From: <[email-masked]>
Date: Mon, Apr 22, 2013 at 9:03 PM
Subject: [IPsec] I-D Action: draft-ietf-ipsecme-ad-vpn-problem-06.txt
To: [email-masked]
Cc: [email-masked]

A New Internet-Draft is available from the on-line Internet-Drafts
directories.
 This draft is a work item of the IP Security Maintenance and Extensions
Working Group of the IETF.

        Title           : Auto Discovery VPN Problem Statement and
Requirements
        Author(s)       : Steve Hanna
                          Vishwas Manral
        Filename        : draft-ietf-ipsecme-ad-vpn-problem-06.txt
        Pages           : 11
        Date            : 2013-04-22

Abstract:
   This document describes the problem of enabling a large number of
   systems to communicate directly using IPsec to protect the traffic
   between them.  It then expands on the requirements, for such a
   solution.

   Manual configuration of all possible tunnels is too cumbersome in
   many such cases.  In other cases the IP address of endpoints change
   or the endpoints may be behind NAT gateways, making static
   configuration impossible.  The Auto Discovery VPN solution will
   address these requirements.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-ipsecme-ad-vpn-problem

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-ipsecme-ad-vpn-problem-06

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-ipsecme-ad-vpn-problem-06

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Paul Hoffman <[email-masked]>
Date: Sat, 27 Apr 2013 07:57:52 -0700

These requirements might be useful to add in the next draft, but they need to be refined.

On Apr 26, 2013, at 8:10 PM, Toby Mao <[email-masked]> wrote:

> The ADVPN solution SHOULD be able to implement Quality of Service (QoS) to regulate the traffic in the ADVPN topology.

Why is this statement needed? Do you see situations where an ADVPN solution would be *prevented* from implementing some sort of QoS because it was an ADVPN?

> ADVPN peer SHOULD NOT send excessive traffic to the other members of ADVPN.

How would you define "excessive"? Where would that measurement be done?

> The traffic for each ADVPN peer CAN be measured individually for shaping and policing.

Why is this statement needed? Do you see situations where an ADVPN solution would be *prevented* from measuring individually?

--Paul Hoffman

---

From: Vishwas Manral <[email-masked]>
Date: Mon, 29 Apr 2013 09:30:15 +0530

Hi Toby,

I absolutely understand the rational of where you are coming from. I agree
with questions raised by Paul - we need to be characterize the requirement
a bit further.

I know QoS is important especially if there is an overload of traffic with
multiple different use cases. However do we see it any different from any
other VPN we currently run? I agree policing, shaping, marking etc are
mechanisms to implement QoS and are important. May be the requirement would
be to specify the capability to do fine grained QoS on a per peer basis on
the Hub. Sounds reasonable?

Thanks,
Vishwas

On Sat, Apr 27, 2013 at 8:27 PM, Paul Hoffman <[email-masked]> wrote:

> > The ADVPN solution SHOULD be able to implement Quality of Service (QoS)
> to regulate the traffic in the ADVPN topology.
>
> Why is this statement needed? Do you see situations where an ADVPN
> solution would be *prevented* from implementing some sort of QoS because it
> was an ADVPN?
>
> Why is this statement needed? Do you see situations where an ADVPN
> solution would be *prevented* from measuring individually?
>
> --Paul Hoffman