Subject: ISDN routers, VPN and staying alive pings - work done?

From: [email-masked]
Date: Tue, 24 Nov 1998 11:12:46 +0100

Today most ISDN routers are capable of keeping a connection alive at both
ends, when the ISDN connection terminate. TCP (mostly), UDP (sometimes)
and IPX is spoofed in the local router, not sending staying alive messages
over the ISDN link.

When running a VPN connection over Internet through a ISP ISDN, specially
a encrypted one, this is not the case, the messages wake up the connection.
If a site need to connect to places with VPN and need to go over a ISP ISDN
connection, this can be rather problematic mainly from a economical point
of
view.

My questions, after scanning the RFC's, are two :

a. has any standard group looked into this or is this just a router
manufacture
     problem.

b. VPN is just mentioned as secondaries in two of the RFC's, although most
    VPN makers is or will implement IPSec as encryption tool for their
products.
    Has work into a RFC for VPN been discussed or is it on line allready?

Regards,

Lars Magnusson
IS-manager/Internet Infrastructure
Saab Automobile AB, Sweden

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Tue, 24 Nov 1998 13:33:13 +0100

At 11:12 24.11.98 +0100, [email-masked] wrote:
>of view.

<Soapbox>

Keepalives are evil.

Spoofing keepalives is evil squared.

Breaking end-to-end security in order to spoof keepalives is evil cubed.

</soapbox>

The RIGHT solution is to stop sending keepalives.
If one end needs to know if the other end is still there, it should
monitor that fact using something apart from a keepalive, and ONLY when
there's an operational need for it.

If it's operationally acceptable to spoof keepalives, it means that it's
operationally acceptable to not use keepalives.
If you don't send keepalives, TCP connections don't die as long as
nothing happens.

But back to real life, where application do the damnedest things, and
network equipment has to deal with what comes along, evil or not:

In a VPN constructed of encrypted tunnels, the slightly less evil
(only squared :-) solution is to make the border routers do the spoofing;
since these boxes will often be of the same kind used for ISDN termination,
the code "should be there", but you might need to lean more than slightly
on the vendor to make him call the right code at the right point.

                          Harald

-- 
Harald Tveit Alvestrand, Maxware, Norway
[email-masked]

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Tue, 24 Nov 1998 13:33:13 +0100

<Soapbox>

Keepalives are evil.

</soapbox>

                          Harald