There still are questions and complexities surrounding how to manage those digital certificates, such as how to issue them to thousands of remote-access users. That will be a big challenge for the emerging Windows 2000 crowd. The IETF already has tackled some of the glaring holes in IPSec, with extensions like the Extended Authentication Protocol, which lets network managers integrate user-authentication methods such as Radius, smart cards and biometrics with IPSec. Lotus, Cisco, Entrust and others each have their own PKIs. One problem, according to Booth, is that some vendors issue encryption keys in flat-file format and others in an encoded format.
Policy is another question.
Most IPSec vendors have their own policy mechanisms so network managers can give certain nodes access to others, but there is no standard way of doing that yet. Rosati notes that there's now a protocol in the works for this at the IETF called the Policy Exchange Resolution Protocol, which should help. But network managers still can't run every IPSec product out of the box with every other one. Efforts like ANX and the VPN Consortium should iron out some of the differences, including how vendors issue digital certificates, so you can use certificates for authenticating sessions with your trading partner. A good IP technology hasn't really arrived until it fades into the network fabric.