Subject: [IPsec] Benoit Claise's No Objection on draft-ietf-ipsecme-tcp-encaps-09: (with COMMENT)

From: Benoit Claise <[email-masked]>
Date: Thu, 27 Apr 2017 05:39:26 -0700

Benoit Claise has entered the following ballot position for
draft-ietf-ipsecme-tcp-encaps-09: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-ipsecme-tcp-encaps/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Just sharing some random thoughts. No action is needed here. 

   Most implementations should use TCP
   Encapsulation only on networks where negotiation over UDP has been
   attempted without receiving responses from the peer, or if a network
   is known to not support UDP.

On one side, some companies deny IKE/IPSEC on purpose.
In the future, they will just block port 4500.

   This document leaves the selection of TCP ports up to
   implementations.  It is suggested to use TCP port 4500, which is
   allocated for IPsec NAT Traversal.

Well, if any port can be used, that becomes difficult.
On the other hand, just is like any tunneling mechanisms, which exist for
some time already.

QoS within TCP will be a real operational issues, as inner to outer ToS
mapping is not possible.