Re: [IPsec] draft-kivinen-ipsecme-esp-null-heuristics comments

[Tero Kivinen <kivinen at iki.fi>]

Bhatia, Manav (Manav) writes:
> > 
> > > BTW, insider threats are on the rise according to various public
> > > reports, so should not be discounted. This is one of the motivations
> > > of employing security, even within the Enterprise.
> > 
> > Yes, but I do not really think people are going to solve those using
> > ESP-NULL. I think they must move to encrypted ESP to provide
> > confidentiality also, and that makes the need for ESP-NULL visibility
> > even less.
> 
> I disagree. With AH as a MAY and ESP as MUST in IPSec, most vendors
> will implement ESP (besides the problem of AH being NAT unfriendly).
> All applications (OSPFv3, RIPng, etc), and there are many, which
> don't care about confidentiality, but are only concerned with
> authentication and integrity assurance, will continue using
> ESP-NULL.  
> 
> Thus there is a need for ESP-NULL visibility. 

What kind of deep inspection you are doing on the OSPFv3 and RIPng in
the middle boxes? I.e. why does middle boxes need to know anything
about the actual data contents of those protocols?

You gave reasons why ESP-NULL is needed, not why ESP-NULL visibility
is needed. 
-- 
kivinen at iki.fi