[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Pki4ipsec] Re: [Ipsec] big IKE packets
-----BEGIN PGP SIGNED MESSAGE-----
>>>>> "Dan" == Dan McDonald <danmcd@east.sun.com> writes:
Dan> Can't modern firewalls tag the initial segment's ID, and let
Dan> matching IDs through? I know there's packet reordering and
Dan> implementations that send the last fragment first, but the
Dan> former is relatively rare, and the latter can be fixed.
Yes, modern firewalls do all of this.
But, consumer grade DSL sharing devices, and multiple "cheap" DSLAM
boxes that provide for "virus protection" do not do this.
My experience is that neither side of the IPsec connection was in
control of these boxes, often unaware of them, and worse -- the ISPs
themselves were often ignorant of them.
IKEv1 PSK will work fine, or RSA without CERTREQ/CERT, but not with
the CERT in place.
Dan> And IPv4 can be configured to act just like IPv6 in this
Dan> regard. Our IP, for example, sets the DF bit by default on
Dan> outbound packets.
Paul> I dislike inventing new protocols to address previously solved
Paul> problems.
Dan> I agree with Paul 100%. Let's not reinvent the wheel more than
Dan> we have to in IKEv2.
I agree. I'd rather use TCP. I don't think it is practical to do that.
(remember, that I'd prefer never to send the certificates in-band at all...)
- --
] "Elmo went to the wrong fundraiser" - The Simpson | firewalls [
] Michael Richardson, Xelerance Corporation, Ottawa, ON |net architect[
] mcr@xelerance.com http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
Comment: Finger me for keys
iQCVAwUBQTThsYqHRg3pndX9AQFI3gP+KHxGI53iwsgEbLRPKUAo5JjPywVX/Apv
hKGRY72m6A6AKLNr+aGLz1MYwruYPHRVKd9sbEB5uT0xC3RkR9vGyUOvT1DvF7U3
pQ2gMf/zQ1Pnp3zq6LgEVBd/9eYloUc87CkVszvgvPVLGV1lEeFv7Tb1K4YqXOoz
dujVlPZjGSA=
=dk/J
-----END PGP SIGNATURE-----
_______________________________________________
Ipsec mailing list
Ipsec@ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec