Re: [IPsec] draft-kivinen-ipsecme-esp-null-heuristics comments

["Bhatia, Manav (Manav)" <manav at alcatel-lucent.com>]

> > > Yes, but I do not really think people are going to solve 
> those using
> > > ESP-NULL. I think they must move to encrypted ESP to provide
> > > confidentiality also, and that makes the need for 
> ESP-NULL visibility
> > > even less.
> > 
> > I disagree. With AH as a MAY and ESP as MUST in IPSec, most vendors
> > will implement ESP (besides the problem of AH being NAT unfriendly).
> > All applications (OSPFv3, RIPng, etc), and there are many, which
> > don't care about confidentiality, but are only concerned with
> > authentication and integrity assurance, will continue using
> > ESP-NULL.  
> > 
> > Thus there is a need for ESP-NULL visibility. 
> 
> What kind of deep inspection you are doing on the OSPFv3 and RIPng in
> the middle boxes? I.e. why does middle boxes need to know anything
> about the actual data contents of those protocols?
> 
> You gave reasons why ESP-NULL is needed, not why ESP-NULL visibility
> is needed. 

One might want to filter OSPFv3 packets coming from outside the domain.

Then when you're the end node, you might want to prioritize some OSPF packets over the others. I understand that the latter is an implementation specific issue, but it helps if the underlying protocol is amenable for deep inspection.

Cheers, Manav