Re: Re: [Ipsec] Asymmetric Security

I think asymmetric scenarios can be interesting in some
cases. But I would recommend discussing the specific
problems in the context that they came up.

For instance, we are discussing in MOBIKE WG on whether
the two peers must always use the same pair of addresses
or if they can end up using different addresses due to
failures or movements. The answer to this question
has a lot to do with the complexity of the failure
detection and address pair decision algorithms; this
is quite specific to MOBIKE.

I have seen Yoav's cluster scenario pop up several
times, so it looks like a valid requirement. But
exactly how that should be solved (separate gateways
or not) and whether current specifications need
some enhancement for this is something that the
IPsec WG should discuss. (There's perhaps a meta-issue
of how IPsec architecture and IKE maintenance will
happen in the future, if the IPsec WG is shut down
as predicted. But that's a general procedural issue,
and not specific to asymmetry.)

--Jari