RE: iSCSI: Outboard Tunnel Mode

[Black_David@emc.com]

So that when a situation arises in which the security is needed,
it's available to be used.  It's usually easy to disable something
that is present but not needed, but it's much harder to enable
something that is needed but present.  As John indicated earlier,
this is a closed issue based on instructions from the IESG.
Comments questioning the IESG's wisdom should be sent to the IESG
or (preferably) /dev/null.

Thanks,
--David

---------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 42 South St., Hopkinton, MA  01748
+1 (508) 435-1000            FAX: +1 (508) 497-8500
black_david@emc.com       Mobile: +1 (978) 394-7754
---------------------------------------------------

> -----Original Message-----
> From: Lakshmi Ramasubramanian [mailto:nramas@windows.microsoft.com]
> Sent: Monday, December 17, 2001 3:39 PM
> To: John Hufferd; VAHUJA@aol.com
> Cc: ips@ece.cmu.edu
> Subject: RE:iSCSI: Outboard Tunnel Mode
> 
> 
> If it is NOT MUST USE, I guess most implementations would just 
> choose "None" for security options. What is the point in saying 
> MUST IMPLEMENT but is NOT MUST USE?
> 
>  -lakshmi
> 
> -----Original Message-----
> From: John Hufferd [mailto:hufferd@us.ibm.com] 
> Sent: Monday, December 17, 2001 11:13 AM
> To: VAHUJA@aol.com
> Cc: ips@ece.cmu.edu
> Subject: Re: Outboard Tunnel Mode
> 
> 
> 
> Installations can do what ever they want.  The Security functions are
> must implement, NOT must use.
> 
> .
> .
> .
> John L. Hufferd
> Senior Technical Staff Member (STSM)
> IBM/SSG San Jose Ca
> Main Office (408) 256-0403, Tie: 276-0403,  eFax: (408) 904-4688 Home
> Office (408) 997-6136, Cell: (408) 499-9702 Internet address:
> hufferd@us.ibm.com
> 
> 
> VAHUJA@aol.com@ece.cmu.edu on 12/17/2001 10:09:10 AM
> 
> Sent by:  owner-ips@ece.cmu.edu
> 
> 
> To:   ips@ece.cmu.edu
> cc:
> Subject:  Outboard Tunnel Mode
> 
> 
> 
> Folks,
> 
> May be I missed something in SLC meeting.  I can expect several
> implementations of iSCSI not include any security.Reason - I can see
> that customers would often rely on the company's existing 
> VPNs (outboard
> Router
> etc) to protect their data (storage or otherwise) over IP 
> networks. From
> a CIO's viewpoint, this approach may make more sense than 
> extending yet
> another layer of IPSec into its servers just for storage data.
> 
>  It is not clear to me from the standard if it will be a 
> non-compliance
> of iSCSI standard. If so, we may potentially have many 
> non-compliances.
> 
> 
>