On Fri, 10 Jan 2014, Stephen Farrell wrote:
- I understand MPLS traffic is often protected at a higher layer by
IPsec. If we had a good opportunistic solution for IKE/IPsec, it could
also cover this use case. And we know people are working on such
solutions. [Here, that's me and my little turf war].
I think opportunistic IPsec could certainly help yes. I'm not
sure if this use-case is being considered in that work.
Any non host-host case is very hard, as there is no way to verify any
claims for random subnets of the internet. AFAIK, no good methods exist
that any OE IPsec could use for auto-configuration. There is quite a
difference between "here is plaintext from you to Bob, encrypt it" and
"here is plaintext from you to Bob at 8.8.8.0/24, encrypt to Mallory".
This is different from the normal IPsec OE scenario, and as a result may
be easier to solve:
- The MPLS peer is already willing to send any traffic from the private
network to the other peer, which it sincerely hopes is not a MITM.
- Each peer is typically running on an edge router (I believe) and so
has much more awareness of the network than your typical IPsec OE peer.
They will actually have the BGP information.
Thanks,
Yaron
_______________________________________________
perpass mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/perpass
