Subject: Re: [Diffserv] ToS, IPSec and Anti replay

From: Praveen Muley <[email-masked]>
Date: Tue, 11 Jul 2000 11:37:01 -0700 (PDT)

Hi Brian,
     The reordering requirement really applies
to packets after traversing the tunnels
and before delivery to the application or
next processing module. this can be achieved
by processing at the tunnel endpoints. 
such a capability should not be excluded
from consideration. Having separate tunnels
per diffserv class removes the need for this
tunnel endpoint processing, but has significant
resource utilization and scalability disadvantages.
              
Thanks,
Praveen 
--- Brian E Carpenter <[email-masked]> wrote:
> Praveen,
> 
> In general, diffserv requires non-reordering of
> microflows,
> quite independent of any security/replay issues.
> Packets
> hidden inside a tunnel should respect this
> constraint.
> Because they are hidden, you can't see the
> microflows, so this 
> translates into a non-reordering requirement on the
> tunnel.
> 
>    Brian
> 
> Praveen Muley wrote:
> > 
> > Hi David,
> >        I think you must have touched this point
> > earlier but would like to know as to why
> architechture
> > wise we are restricting of not having reordering
> > within a tunnel if by some other means we are able
> to
> > solve the issue.
> >          Instead of should can we have a may over
> > there.
> >        Sorry about going all over back.
> > 
> > Thanks,
> > Praveen
> > 
> > --- [email-masked] wrote:
> > > > So, just so I am clear. If I have 2 classes of
> > > service and one tunnel
> > > > for both, and packets are out of order, you
> are
> > > saying that it is the
> > > > IPSec anti-replay windows problem? The
> solution is
> > > a tunnel per class of
> > > > service.
> > >
> > > That's one possibility.  Here's the complete
> story
> > > -- IF
> > >
> > > (1) You have two classes of service AND
> > > (2) You want to run them in IPSec tunnel mode
> AND
> > > (3) You want them differentiated in a way that
> > > reorders packets within the
> > > tunnel AND
> > > (4) You want to use IPSec anti-replay protection
> AND
> > > (5) You want to use a single tunnel.
> > >
> > > THEN you have a problem, because the last three
> > > items cannot in general be
> > > done at
> > > the same time without having the IPSec
> anti-replay
> > > protection complain or
> > > worse.
> > >
> > > There are three possible solutions based on
> which
> > > item is left out:
> > >
> > > (A) Leave out (3) by marking the same class of
> > > service on the outer
> > >       IP headers even though there are multiple
> classes
> > > carried in the
> > > tunnel.
> > >       There will be no packet reordering within
> the
> > > tunnel.
> > > (B) Leave out (4) by not configuring IPSec
> > > anti-replay protection.
> > > (C) Leave out (5) by using a tunnel per class of
> > > service that you want
> > > differentiated.
> > >       This uses additional resources to support
> the
> > > additional tunnels.
> > >
> > > Again, please check the text in
> > > draft-ietf-diffserv-tunnels-01.txt, which
> > > is in informal last call at the moment.  The
> text in
> > > Sections 5.1 and 5.2
> > > is supposed to address *exactly* this issue - if
> the
> > > text is not
> > > sufficiently clear, I need to make it so, and
> would
> > > appreciate suggestions.
> > >
> > > Thanks,
> > > --David
> > >
> > >
> ---------------------------------------------------
> > > David L. Black, Senior Technologist
> > > EMC Corporation, 42 South St., Hopkinton, MA 
> 01748
> > > +1 (508) 435-1000 x75140, FAX: +1 (508) 497-6909
> > > [email-masked]  Cellular: +1 (978) 394-7754
> > >
> ---------------------------------------------------
> > >
> > 
> > __________________________________________________
> > Do You Yahoo!?
> > Get Yahoo! Mail – Free email you can access from
> anywhere!
> > http://mail.yahoo.com/
> > 
> > _______________________________________________
> > diffserv mailing list
> > [email-masked]
> > http://www1.ietf.org/mailman/listinfo/diffserv
> > Archive: http://www-nrg.ee.lbl.gov/diff-serv-arch/
> 
> -- 
> - - - - - - - - - - - - - - - - - - - - - - - - - -
> - - - - - - -
> Brian E Carpenter 
> Program Director, Internet Standards & Technology,
> IBM 
> On assignment for IBM at http://www.iCAIR.org 
> Attend INET 2000: http://www.isoc.org/inet2000
> Non-IBM email: [email-masked]

__________________________________________________
Do You Yahoo!?
Get Yahoo! Mail – Free email you can access from anywhere!
http://mail.yahoo.com/

_______________________________________________
diffserv mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/diffserv
Archive: http://www-nrg.ee.lbl.gov/diff-serv-arch/

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 11 Jul 2000 15:54:48 -0500

I don't think it is excluded, since David's draft
specifically allows traffic conditioning at
that point.

   Brian