RE: Security and iSCSI and IPv6

Gaurav,
 
I think you answered your own question ...
 
IPsec is mandatory in the iSCSI RFCs for both IPv4 and IPv6.
 
I would have thought that at least the first "MUST" in the
green text you quoted from RFC 3720 would suffice to make
this clear.
 
--David
---------------------------------------------------- 
David L. Black, Senior Technologist 
EMC Corporation, 176 South St., Hopkinton, MA  01748 
+1 (508) 293-7953             FAX: +1 (508) 293-7786 
[email protected]        Mobile: +1 (978) 394-7754 
---------------------------------------------------- 


________________________________

	From: [email protected] [mailto:[email protected]] 
	Sent: Wednesday, November 01, 2006 10:51 AM
	To: Black, David; [email protected]; [email protected]
	Cc: [email protected]
	Subject: RE: [Ips] Security and iSCSI and IPv6
	
	
	David,
	 
	We wanted to find out, if iSCSI spec mandates initiator or
target to support any aspect of IPSEC (authentication or encryption) in
IPv6 or IPv4 environment. or Is IPSEC completely optional?
	 
	Section 8.3.1 in RFC 3720 states that:

		An iSCSI compliant initiator or target MUST provide data
integrity
		   and authentication by implementing IPsec [RFC2401]
with ESP [RFC2406]
		   in tunnel mode and MAY provide data integrity and
authentication by
		   implementing IPsec with ESP in transport mode.  The
IPsec
		   implementation MUST fulfill the following iSCSI
specific
		   requirements:
		 
		     - HMAC-SHA1 MUST be implemented [RFC2404].
		     - AES CBC MAC with XCBC extensions SHOULD be
implemented
		       [RFC3566].
		 
		   The ESP anti-replay service MUST also be implemented.

	Thanks, 
	Gaurav

	 

________________________________

	From: [email protected] [mailto:[email protected]] 
	Sent: Wednesday, November 01, 2006 9:04 AM
	To: Cherian, Jacob; [email protected]
	Subject: RE: [Ips] Security and iSCSI and IPv6
	
	
	The IPsec requirements for iSCSI are IPv6 vs. IPv4 independent
for
	the most part.  Section 8.3.3 of RFC 3720 requires ID_IPV6_ADDR
	support when IPv6 is supported.
	 
	Thanks,
	--David
	---------------------------------------------------- 
	David L. Black, Senior Technologist 
	EMC Corporation, 176 South St., Hopkinton, MA  01748 
	+1 (508) 293-7953             FAX: +1 (508) 293-7786 
	[email protected]        Mobile: +1 (978) 394-7754 
	---------------------------------------------------- 

________________________________

		From: [email protected]
[mailto:[email protected]] 
		Sent: Tuesday, October 31, 2006 6:27 PM
		To: [email protected]
		Subject: [Ips] Security and iSCSI and IPv6
		
		

		Are the any mandatory requirements around support for
IPSec for iSCSI targets that claim IPv6 compliance?

		Any insight would be greatly appreciated.

		

		Thanks,

		Jacob

_______________________________________________
Ips mailing list
[email protected]
https://www1.ietf.org/mailman/listinfo/ips