[ipv6-wg] RIPE-501 and IPSEC on CPEs

On 7/23/11 12:54 AM, S.P.Zeidler wrote:
> Another option would be for LIRs looking for ultra low cost routers to
> take some that don't make the requirements list. Or take CPEs that flag
> themselves as "fulfilling RIPE-501 except IPSEC".

:)

>
> Just because RIPE-501 exists does not mean that devices that don't fulfil
> it will suddenly evaporate, right?
>
> Again, the purpose of such a list is that a device that fulfils it will
> cover most reasonable needs.

agree.

>
> If we strike every feature off that somebody said "oh well I think I can
> do without that" about, it will become a useless "remotely resembling
> functional" description.
>
> Arguing that practically nobody would want their CPE to do IPSEC because
> everybody does host based IPSEC would be a better approach, but I would
> offer that that's going to be patently untrue if you look at company users
> and not private-person-residential users.

Business CPE must support it, residential should.

But, please, have in mind that feedback from this list goes to Ole 
Troan, editor of RFC6204. He suggested to include only RFC6204 as 
mandatory (and that was also response from this community), so in case 
of different ideas RFC6204 might be changed.

Ole, are you in the game? :)

My suggestion would be to add (in addition to RFC6204 in mandatory):

"If this specification is used for business class CPE, then IPsec-v2 
[RFC2401, RFC2406, RFC2402], IKE version 2 (IKEv2) [RFC4306, RFC4718] 
and ISAKMP [RFC2407, RFC2408, RFC2409] must be supported in addition to 
RFC6204 requirements"

Suggestions, opinions?

Cheers, Jan

Cheers, Jan