Subject: RE: [Diffserv] ToS, IPSec and Anti replay

From: Praveen Muley <[email-masked]>
Date: Mon, 10 Jul 2000 11:15:16 -0700 (PDT)

Hi David, 
       I think you must have touched this point
earlier but would like to know as to why architechture
wise we are restricting of not having reordering
within a tunnel if by some other means we are able to
solve the issue. 
         Instead of should can we have a may over
there.
       Sorry about going all over back.

Thanks,
Praveen

--- [email-masked] wrote:
> > So, just so I am clear. If I have 2 classes of
> service and one tunnel
> > for both, and packets are out of order, you are
> saying that it is the
> > IPSec anti-replay windows problem? The solution is
> a tunnel per class of
> > service.
> 
> That's one possibility.  Here's the complete story
> -- IF
> 
> (1) You have two classes of service AND
> (2) You want to run them in IPSec tunnel mode AND
> (3) You want them differentiated in a way that
> reorders packets within the
> tunnel AND
> (4) You want to use IPSec anti-replay protection AND
> (5) You want to use a single tunnel.
> 
> THEN you have a problem, because the last three
> items cannot in general be
> done at
> the same time without having the IPSec anti-replay
> protection complain or
> worse.
> 
> There are three possible solutions based on which
> item is left out:
> 
> (A) Leave out (3) by marking the same class of
> service on the outer
> 	IP headers even though there are multiple classes
> carried in the
> tunnel.
> 	There will be no packet reordering within the
> tunnel.
> (B) Leave out (4) by not configuring IPSec
> anti-replay protection.
> (C) Leave out (5) by using a tunnel per class of
> service that you want
> differentiated.
> 	This uses additional resources to support the
> additional tunnels.
> 
> Again, please check the text in
> draft-ietf-diffserv-tunnels-01.txt, which
> is in informal last call at the moment.  The text in
> Sections 5.1 and 5.2
> is supposed to address *exactly* this issue - if the
> text is not
> sufficiently clear, I need to make it so, and would
> appreciate suggestions.
> 
> Thanks,
> --David
> 
> ---------------------------------------------------
> David L. Black, Senior Technologist
> EMC Corporation, 42 South St., Hopkinton, MA  01748
> +1 (508) 435-1000 x75140, FAX: +1 (508) 497-6909
> [email-masked]  Cellular: +1 (978) 394-7754
> ---------------------------------------------------
> 

__________________________________________________
Do You Yahoo!?
Get Yahoo! Mail – Free email you can access from anywhere!
http://mail.yahoo.com/

_______________________________________________
diffserv mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/diffserv
Archive: http://www-nrg.ee.lbl.gov/diff-serv-arch/

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 11 Jul 2000 09:53:42 -0500

Praveen,

In general, diffserv requires non-reordering of microflows,
quite independent of any security/replay issues. Packets
hidden inside a tunnel should respect this constraint.
Because they are hidden, you can't see the microflows, so this 
translates into a non-reordering requirement on the tunnel.

   Brian

-- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Brian E Carpenter 
Program Director, Internet Standards & Technology, IBM 
On assignment for IBM at http://www.iCAIR.org 
Attend INET 2000: http://www.isoc.org/inet2000
Non-IBM email: [email-masked]