Re: large scale ipsec

2013-11-01 Thread Scott Weeks
--- morrowc.li...@gmail.com wrote: From: Christopher Morrow One good reason to not do link encryption is: "the problem is that whackadoodle box you put outside the router!" :( most often those boxes can't do light-level monitoring, loopbacks, etc... all the stuff your NOC wants to do when 'link

Re: large scale ipsec

2013-11-01 Thread Christopher Morrow
On Fri, Nov 1, 2013 at 1:06 PM, Jan Schaumann wrote: > Christopher Morrow wrote: > >> One might look at MS's documentation about deploying end-to-end ipsec >> in their enterprise for one example of peer-to-peer ubiquitous ipsec. > > This is interesting and kind of what I'm looking for. Do you ha

Re: large scale ipsec

2013-11-01 Thread Jan Schaumann
Christopher Morrow wrote: > One might look at MS's documentation about deploying end-to-end ipsec > in their enterprise for one example of peer-to-peer ubiquitous ipsec. This is interesting and kind of what I'm looking for. Do you have a pointer to this documentation? My apologies for not hav

Re: large scale ipsec

2013-11-01 Thread Christopher Morrow
On Fri, Nov 1, 2013 at 10:30 AM, David Barak wrote: > Hi Jan, > > Please define "large scale". Is that by number of endpoints, throughput, or > some other metric? How big is big? > it's fair to believe that there are 'lots' of ipsec deployments where there are ~1000 or so endpoints (network en

Re: large scale ipsec

2013-11-01 Thread David Barak
Hi Jan, Please define "large scale". Is that by number of endpoints, throughput, or some other metric? How big is big? David Barak

Re: large scale ipsec

2013-11-01 Thread Paul Stewart
Can you give us an idea of “large scale” in your mind? Also, site to site deployments or remote access or both? Paul On 11/1/2013, 9:38 AM, "Jan Schaumann" wrote: >Hello, > >Who here on this list has deployed IPSec or other comparable lower layer >encryption in a large scale environment, or a

large scale ipsec

2013-11-01 Thread Jan Schaumann
Hello, Who here on this list has deployed IPSec or other comparable lower layer encryption in a large scale environment, or attempted to do so? I've repeatedly heard claims that doing so is not feasible (either operationally or financially), but I have not seen any specific studies, reports, numb