Subject: RE: [Diffserv] ToS, IPSec and Anti replay

From: [email-masked]
Date: Fri, 23 Jun 2000 17:29:46 -0400

This is a real issue; please read
	draft-ietf-diffserv-tunnels-01.txt
and let me (and the list) know whether the
material in Section 5 (and its subsections)
addresses this adequately.

Thanks,
--David

---------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 42 South St., Hopkinton, MA  01748
+1 (508) 435-1000 x75140, FAX: +1 (508) 497-6909
[email-masked]  Cellular: +1 (978) 394-7754
---------------------------------------------------

> -----Original Message-----
> From:	Scott Fanning [SMTP:[email-masked]]
> Sent:	Friday, June 23, 2000 11:46 AM
> To:	[email-masked]
> Subject:	[Diffserv] ToS, IPSec and Anti replay
> 
> All
> 
> Thanks for the responses to my e-mail concerning the above topic, but I
> don't think I described the
> problem completely so I will try again. Being new to diff-serv, please
> excuse my lack of correct terminology. 
> 
> In ESP and AH, there are sequence numbers that are monotonicly
> increasing. IPSec expects the packets to arrive in order.
> 
> Let DS = QoS Classification
> Let GW = Gateway
> 
>                                             <---------IPSec Tunnel------>
> User A
> User B<---->GW A / DS<-------------->DS<---------->GW B<--->User D
> User C
> 
> User A, B and C all have different classes of service applied to them, but
> all on the same subnet.
> GW A to GW B has a IPsec Tunnel that will tunnel all packets across a
> service providers network for that subnet to the subnet on the other side
> (GW B). Since all traffic goes through one tunnel (Avery common Service
> provider setup), each user with a different ToS octet, when the diff-serve
> device classifies the traffic on the other end, it will go into separate
> queues.
> 
> As these queues will be serviced at different times, the Seq Numbers to GW
> B will be out of order and will be dropped.
> 
> Has anyone seen, or experienced this. As I stated before, anti-replay
> can be turned off at the Receiver end, but it would be better to
> maintain the anti-replay service.
> 
> Thanks
> Scott
>   
> 

_______________________________________________
diffserv mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/diffserv
Archive: http://www-nrg.ee.lbl.gov/diff-serv-arch/

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 27 Jun 2000 10:10:58 -0500

To be even more explicit: we expect to last-call the tunnels
document any time now. Anyone who doesn't believe that it
adequately responds to Scott Fanning's question needs to say
so, so that we can close this issue permanently.

  Brian Carpenter
  diffserv co-chair

-- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Brian E Carpenter 
Program Director, Internet Standards & Technology, IBM 
On assignment for IBM at http://www.iCAIR.org 
Attend INET 2000: http://www.isoc.org/inet2000
Non-IBM email: [email-masked]