RE: VPN Auth (was VPN authentication/verification and WG re-chartering)

["Schliesser, Benson" <bensons at savvis.net>]

Tom-

That's a good point. It can (easily) be argued that these multi-SP cases
are actually the most important for VPN authentication to address...
Certainly, the trust models are complicated. I.e. who owns the customer
relationship, who is managing the service(s), etc. But in any case,
there are too many contributors in the VPN for things to just work
without occasional error. VPN authentication is very valuable in this
environment.

Cheers,
-Benson




> -----Original Message-----
> From: Thomas D. Nadeau [mailto:tnadeau at cisco.com] 
> Sent: Tuesday, June 05, 2007 3:27 PM
> To: Schliesser, Benson
> Cc: l3vpn at ietf.org
> Subject: Re: VPN Auth (was VPN authentication/verification 
> and WG re-chartering)
> 
> 
> > Sorry for replying to my own message, but I would like to encourage
> > discussion around VPN Auth requirements.
> >
> >> I would like to see discussion of the requirements first, so that
> >> candidate solutions have a point of reference.
> >
> > For instance, I would argue that there are several roles/modes of
> > authentication that must be considered: SP-managed, 
> user-managed, and
> > co-managed. Each of these modes have slightly different  
> > requirements, of
> > course, and different alerting and/or response mechanisms.
> 
> 	And one other thing related to an important point you raised
> earlier related would be two other cases: multiple SP-managed, co- 
> managed
> with multiple SPs where there are multiple providers.
> 
> 	--Tom
> 
> 
> > Across all of these modes the primary goal is to be assured that all
> > sites attached to the VPN are intended and allowed to be members.
> > Secondary goals *might* include verification that the CE was  
> > configured
> > by the correct authority (i.e. is not a hacked or replaced 
> device),  
> > that
> > routes originating from the CE (or PE) are legitimate, etc. Maybe a
> > solution for one of the secondary goals might actually solve the  
> > primary
> > goal, too.
> >
> > Any thoughts on these goals, and/or how they translate into 
> technical
> > requirements?
> >
> > Cheers,
> > -Benson
>