Subject: AW: IPSRA WG LAST CALL: draft-ietf-ipsec-dhcp-08.txt

From: Bungert Michael <[email-masked]>
Date: Thu, 7 Dec 2000 10:25:44 +0100

Two questions on the dhcp draft:
On pg. 7 the draft says: If a new IPSEC tunnel is required, the remote host establishes
   a tunnel mode SA to the security gateway in a quick mode exchange.
   In this case, the new address assigned via DHCPv4 MUST be used
   in the quick mode ID.
On pg. 10: After processing of the DHCPACK, the intranet interface is configured
and the internet interface can establish a new IPSEC tunnel mode SA to
the security gateway. The IDci of the quick mode exchange used to
establish the new IPSEC tunnel mode SA should be the address of the
intranet interface as obtained via DHCPv4.

Questions: Is it a MUST or a should and why is it a MUST/a should ?

Michael

> -----Urspr> üngliche Nachricht-----
> Von:	Paul Hoffman / VPNC [SMTP:[email-masked]]
> Gesendet am:	Mittwoch, 29. November 2000 18:02
> An:	[email-masked]
> Betreff:	IPSRA WG LAST CALL: draft-ietf-ipsec-dhcp-08.txt
> 
> This is the beginning of a three-week WG last call on 
> draft-ietf-ipsec-dhcp-08.txt. You can find a copy at 
> <http://www.ietf.org/internet-drafts/draft-ietf-ipsec-dhcp-08.txt>.
> 
> This draft will be discussed in San Diego, but it would be really 
> grand if everyone can look at it sooner and comment on the mailing 
> list. Doing so will make the discussion in San Diego more focused, 
> and allows the authors to respond to requests for changes both on the 
> list and in the face-to-face meeting.
> 
> And, for those of you who are sticklers on procedure, this draft is 
> not officially part of the IPSRA WG work, but it has been 
> unofficially moved to us because of its content. This is a minor 
> status issue and will not affect our discussion nor its eventual 
> standardization status.
> 
> --Paul Hoffman, Director
> --VPN Consortium

---

From: "Bernard Aboba" <[email-masked]>
Date: Thu, 7 Dec 2000 23:35:51 -0800

I think it is a MUST (thanks for catching the error). The idea was
to make sure that there is a binding between the newly assigned
address and the QM SA.

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Bungert Michael
Sent: Thursday, December 07, 2000 1:26 AM
To: [email-masked]
Subject: AW: IPSRA WG LAST CALL: draft-ietf-ipsec-dhcp-08.txt

Two questions on the dhcp draft:
On pg. 7 the draft says: If a new IPSEC tunnel is required, the remote host
establishes
   a tunnel mode SA to the security gateway in a quick mode exchange.
   In this case, the new address assigned via DHCPv4 MUST be used
   in the quick mode ID.
On pg. 10: After processing of the DHCPACK, the intranet interface is
configured
and the internet interface can establish a new IPSEC tunnel mode SA to
the security gateway. The IDci of the quick mode exchange used to
establish the new IPSEC tunnel mode SA should be the address of the
intranet interface as obtained via DHCPv4.

Michael