Re: [IPsec] AD VPN: protocol selection

2013-12-06 Thread Frederic Detienne (fdetienn)
Hi Andreas, On 04 Dec 2013, at 09:59, Andreas Steffen andreas.stef...@strongswan.org wrote: ... - No overlay of additional routing protocols is needed. please note that our proposal does not mandate a routing protocol. We also support IKEv2 config exchange and treat the protected subnets

Re: [IPsec] AD VPN: protocol selection

2013-12-06 Thread Paul Wouters
On Tue, 3 Dec 2013, Yaron Sheffer wrote: There is clear working group interest in a standard auto-discovery VPN solution. We have agreed-upon requirements [1]. I was unfortunately not really active during the requirements phase. While I believe there is a need for auto-discovery without

[IPsec] routing protocols for ADVPN

2013-12-06 Thread Michael Richardson
(thread broken intentionally) Frederic Detienne (fdetienn) fdeti...@cisco.com wrote: ... - No overlay of additional routing protocols is needed. please note that our proposal does not mandate a routing protocol. We also support IKEv2 config exchange and treat the protected

[IPsec] ADVPN vs opportunistic VPN

2013-12-06 Thread Yoav Nir
[Changing the subject to avoid poisoning the protocol selection thread with my author-ness] On 6/12/13 8:05 PM, Paul Wouters wrote: We have agreed-upon requirements [1]. I was unfortunately not really active during the requirements phase. While I believe there is a need for auto-discovery

Re: [IPsec] routing protocols for ADVPN

2013-12-06 Thread Frederic Detienne (fdetienn)
Hi Michael, Sorry; I must have missed your email or misunderstood your questions. I felt that so far we had received comments asking whether something can be done but very few on how. I have been traveling and missed a bunch of emails. I apologize again if I missed them. I will split your

Re: [IPsec] routing protocols for ADVPN

2013-12-06 Thread Frederic Detienne (fdetienn)
On 06 Dec 2013, at 19:41, Michael Richardson mcr+i...@sandelman.ca wrote: ... I'd rather that you had mandated OSPFv2/3 or someso that I could evaluate the entire solution. The point is that we can't mandate that. Each of those protocols have different properties and are better suited in