Subject: Re: [Diffserv] ToS, IPSec and Anti replay

From: Praveen Muley <[email-masked]>
Date: Tue, 27 Jun 2000 20:17:11 -0700 (PDT)

Hi Scott,
      Looks like in this situation we can have an
anti-replay mechanism per Diff. code point basis and
that too as per inner IP header Diff. code ( of course
for security reasons.Malacious user can deliberately
change the Diff. code in which case the anti-replay
mechanism will fail). 
      I hope this might answer the scenario you are
mentioning. 
        Will appreciate your comments.

Thanks,       
-Praveen  
               
--- Brian E Carpenter <[email-masked]> wrote:
> To be even more explicit: we expect to last-call the
> tunnels
> document any time now. Anyone who doesn't believe
> that it
> adequately responds to Scott Fanning's question
> needs to say
> so, so that we can close this issue permanently.
> 
>   Brian Carpenter
>   diffserv co-chair
> 
> [email-masked] wrote:
> > 
> > This is a real issue; please read
> >         draft-ietf-diffserv-tunnels-01.txt
> > and let me (and the list) know whether the
> > material in Section 5 (and its subsections)
> > addresses this adequately.
> > 
> > Thanks,
> > --David
> > 
> >
> ---------------------------------------------------
> > David L. Black, Senior Technologist
> > EMC Corporation, 42 South St., Hopkinton, MA 
> 01748
> > +1 (508) 435-1000 x75140, FAX: +1 (508) 497-6909
> > [email-masked]  Cellular: +1 (978) 394-7754
> >
> ---------------------------------------------------
> > 
> > > -----Original Message-----
> > > From: Scott Fanning [SMTP:[email-masked]]
> > > Sent: Friday, June 23, 2000 11:46 AM
> > > To:   [email-masked]
> > > Subject:      [Diffserv] ToS, IPSec and Anti
> replay
> > >
> > > All
> > >
> > > Thanks for the responses to my e-mail concerning
> the above topic, but I
> > > don't think I described the
> > > problem completely so I will try again. Being
> new to diff-serv, please
> > > excuse my lack of correct terminology.
> > >
> > > In ESP and AH, there are sequence numbers that
> are monotonicly
> > > increasing. IPSec expects the packets to arrive
> in order.
> > >
> > > Let DS = QoS Classification
> > > Let GW = Gateway
> > >
> > >                                            
> <---------IPSec Tunnel------>
> > > User A
> > > User B<---->GW A /
> DS<-------------->DS<---------->GW B<--->User D
> > > User C
> > >
> > > User A, B and C all have different classes of
> service applied to them, but
> > > all on the same subnet.
> > > GW A to GW B has a IPsec Tunnel that will tunnel
> all packets across a
> > > service providers network for that subnet to the
> subnet on the other side
> > > (GW B). Since all traffic goes through one
> tunnel (Avery common Service
> > > provider setup), each user with a different ToS
> octet, when the diff-serve
> > > device classifies the traffic on the other end,
> it will go into separate
> > > queues.
> > >
> > > As these queues will be serviced at different
> times, the Seq Numbers to GW
> > > B will be out of order and will be dropped.
> > >
> > > Has anyone seen, or experienced this. As I
> stated before, anti-replay
> > > can be turned off at the Receiver end, but it
> would be better to
> > > maintain the anti-replay service.
> > >
> > > Thanks
> > > Scott
> > >
> > >
> > 
> > _______________________________________________
> > diffserv mailing list
> > [email-masked]
> > http://www1.ietf.org/mailman/listinfo/diffserv
> > Archive: http://www-nrg.ee.lbl.gov/diff-serv-arch/
> 
> -- 
> - - - - - - - - - - - - - - - - - - - - - - - - - -
> - - - - - - -
> Brian E Carpenter 
> Program Director, Internet Standards & Technology,
> IBM 
> On assignment for IBM at http://www.iCAIR.org 
> Attend INET 2000: http://www.isoc.org/inet2000
> Non-IBM email: [email-masked]
> 
> _______________________________________________
> diffserv mailing list
> [email-masked]
> http://www1.ietf.org/mailman/listinfo/diffserv
> Archive: http://www-nrg.ee.lbl.gov/diff-serv-arch/
> 

__________________________________________________
Do You Yahoo!?
Get Yahoo! Mail - Free email you can access from anywhere!
http://mail.yahoo.com/

_______________________________________________
diffserv mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/diffserv
Archive: http://www-nrg.ee.lbl.gov/diff-serv-arch/

---

From: Praveen Muley <[email-masked]>
Date: Tue, 27 Jun 2000 20:23:07 -0700 (PDT)

Hi Scott,
      Can have an anti-replay mechanism per Diff. Code
point basis that too on inner IP header's Diff. code
point ( of course for security reason).
      Hope this might answer the scenario you are
mentioning. 
      Will appreciate your comments. 

Thanks,
Praveen

---

From: Praveen Muley <[email-masked]>
Date: Wed, 28 Jun 2000 11:23:09 -0700 (PDT)

I think will makes more sense to do anti-replay
mechanism AF class ( in AF scenario) basis than DS
code point basis.

Thanks,
Praveen
--- Praveen Muley <[email-masked]> wrote:
> > > Archive:
> http://www-nrg.ee.lbl.gov/diff-serv-arch/
> > 
> > --