On Tue, 8 Nov 2011, Geoffrey Huang wrote:
Yes - so if something has to be added to DNS, then how would this be better or
more preferable than adding an extension to IKE?
DNS would act as a bootstrap to find the IKE daemon for a particular target(s).
Everything else
should indeed remain within the IKE daemon.
That is exactly what RFC 4025 does.
Paul
-geoff
-----Original Message-----
From: Yoav Nir [mailto:[email protected]]
Sent: Tuesday, November 08, 2011 4:23 PM
To: Geoffrey Huang; [email protected]
Cc: [email protected]; bill manning; Praveen Sathyanarayan
Subject: Re: [IPsec] New -00 draft: Creating Large Scale Mesh VPNs Problem
There isn't now, but adding stuff to the DNS is all the rage now that DNSSEC,
ummm, exists. Just take a look at DANE.
On 11/8/11 5:18 PM, "Geoffrey Huang" <[email protected]> wrote:
Is there a mechanism in DNS to communicate this kind of policy? As I
understand the example below, the communication from hub-gw to spoke32
would be something like: "to get to 192.168.79.0/24, go to spoke79."
-geoff
-----Original Message-----
From: [email protected] [mailto:[email protected]]
Sent: Monday, November 07, 2011 10:46 PM
To: Yoav Nir
Cc: [email protected]; Geoffrey Huang; bill manning; Praveen Sathyanarayan
Subject: Re: [IPsec] New -00 draft: Creating Large Scale Mesh VPNs
Problem
"Yoav" == Yoav Nir <[email protected]> writes:
Yoav> I don't see how DNS figures into this. We have three
Yoav> gateways: - hub-gw, which knows the protected domains of
Yoav> everyone - spoke32, which protects 192.168.32.0/24, knows
Yoav> about hub-gw, and sends all 192.168.0.0/16 to hub-gw. -
Yoav> spoke79, which protects 192.168.79.0/24, knows about hub-gw,
Yoav> and sends all 192.168.0.0/16 to hub-gw
>> Yes. And, how is this policy communicated?
Yoav> Over IKE?
Yoav> Using a new protocol that we'll invent?
Yoav> SOAP?
Yoav> As an attribute in a certificate, kind of like SIDR?
So, okay, so you want to do new work to replace work that's already
been well defined, that uses DNS as the transport.
_______________________________________________
IPsec mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/ipsec
_______________________________________________
IPsec mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/ipsec
