Towards a policy system for IPsec: issues and an experimental implementation

IPsec, the standard suite of protocols to provide security in IP networks, and IKE, the commonly used key, management protocol for IPsec, do not address the more general problem of how security policies should be distributed to IPsec nodes. Previous IETF work in the area of network security, provides a definition of the basic requirements of an IP security policy system (IPSP) and a proposal of a security policy protocol (SPP) to exchange security policies. IPSP recommends that traditional mechanisms for distributing network management information (SNMP, COPS) should also be taken into consideration. The first objective of this paper is to evaluate the suitability, of existing network management mechanisms to achieve the goals of IPSP. Subsequently, the paper describes and discusses an approach followed in the implementation of an IPSP system, with emphasis on the implementation of SPP.