Re: Adding revised identities to IKEv2

[Brian Korver <briank@briank.com>]

Paul Hoffman / VPNC writes:
> Why? What people have found from many years of VPN deployment is that 
> customers generally want one of two things:
> - The ability to say "let any gateway with this identity set up any 
> kind of tunnel with me"
> - The ability to say "let the gateway with this identity set up a 
> tunnel with these features"
> For preshared secrets, there is no question of the identity. For PKIX 
> certificates, the identity problem is so convoluted, almost all 
> customers say "any identity is OK as long as the certificate 
> correctly chains to this trusted root". The identity is logged, but 
> the type of identity is not related to the ability to set up tunnels.

While we're on this topic, I'll interject that a reorganized but
largely the same draft-ietf-ipsec-pki-profile-01.txt is just out
and attempts to address these issues.


> It would be silly to put your cert *behind* your gateway. But the 
> gateway itself might have a trivial HTTP server to allow access to 
> certs; in fact, this is what many people expect to happen.
> 
> --Paul Hoffman, Director
> --VPN Consortium
> 

-brian
briank@briank.com