Subject: RE: [Diffserv] IPSec and Anti-Replay

From: Shahram Davari <[email-masked]>
Date: Thu, 15 Jun 2000 07:50:08 -0700

Michael,

In order to prevent reordering, you should not assign more than one OA
(ordered Aggregate) to the same IPsec flow (single SA). Otherwise reordering
will happen.

Ordered Aggregate (OA):  A set of Behavior Aggregates that share an
ordering constraint.  The set of PHBs that are applied to this set
of Behavior Aggregates constitutes a PHB scheduling class.

Regards,
-Shahram

>-----Original Message-----
>From: Michael Richardson [mailto:[email-masked]]
>Sent: Wednesday, June 14, 2000 10:59 PM
>To: [email-masked]
>Subject: Re: [Diffserv] IPSec and Anti-Replay 
>
>
>
>>>>>> "Steve" == Steve Kohalmi <[email-masked]> writes:
>    Steve> As a "punishment" you changing the packet's drop 
>probability,
>    Steve> while keeping it on the same queue. That is exactly 
>the reason for
>    Steve> AF differentiating between Classes and Drop 
>Precedences. This is
>    Steve> pretty clear in RFC-2597.
>
>  So, reording of IPsec packets is not an issue.
>  Problem solved.
>
>   :!mcr!:            |  Solidum Systems Corporation, 
>http://www.solidum.com
>   Michael Richardson |For a better connected world,where data 
>flows faster<tm>
> Personal: 
>http://www.sandelman.ottawa.on.ca/People/Michael_Richardson/Bio.html
>	mailto:[email-masked]	mailto:[email-masked]
>
>
>
>_______________________________________________
>diffserv mailing list
>[email-masked]
>http://www1.ietf.org/mailman/listinfo/diffserv
>Archive: http://www-nrg.ee.lbl.gov/diff-serv-arch/
>

_______________________________________________
diffserv mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/diffserv
Archive: http://www-nrg.ee.lbl.gov/diff-serv-arch/

---

From: Michael Richardson <[email-masked]>
Date: Thu, 15 Jun 2000 13:33:00 -0400

>>>>> "Shahram" == Shahram Davari <[email-masked]> writes:
    Shahram> In order to prevent reordering, you should not assign more than
    Shahram> one OA (ordered Aggregate) to the same IPsec flow (single
    Shahram> SA). Otherwise reordering will happen.

  How could a diffserv box tell how many OA's I put into the same SA
if the flow is encrypted? The ordering constrainst is not that hard for
IPsec itself (it can handle some reordering of packets). I understand that
a IPphone may have stronger constraints.

  The key message is, though, if you want different policies applied to
different OA's, they need to go into seperate IPsec flows. They have seperate
SPIs and there is no problem.

   :!mcr!:            |  Solidum Systems Corporation, http://www.solidum.com
   Michael Richardson |For a better connected world,where data flows faster<tm>
 Personal: http://www.sandelman.ottawa.on.ca/People/Michael_Richardson/Bio.html
	mailto:[email-masked]	mailto:[email-masked]

---

From: Mark Duffy <[email-masked]>
Date: Thu, 15 Jun 2000 15:26:32 -0400

I believe the point here is that when a device (i.e. the "diffserv box" you
mention) is acting as an IPsec Security Gateway, AND it is copying the
DSCPs from the inner packets to the outer packets, AND it is putting
packets from more than one Ordered Aggregate onto the same IPsec Secuity
Association, THEN you are likely to see a reordering issue if using IPsec
Anti-Replay.

-Mark