Subject: RE: [Diffserv] ToS, IPSec and Anti replay

From: "Scott Fanning" <[email-masked]>
Date: Fri, 30 Jun 2000 21:10:35 -0700

While this would solve the problem, this is the equivalent of a IPSec Tunnel
per ToS (DSCP). That will not be acceptable on smaller boxes that can not do
large numbers of tunnels. I am going over the tunnels document over the
weekend and will get some comments back ASAP.

Thanks for everybody's comments. Looking forward to the WG meeting :-)

Thanks
Scott

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf
> Of Praveen Muley
> Sent: Tuesday, June 27, 2000 8:23 PM
> To: Brian E Carpenter; [email-masked]
> Cc: [email-masked]; [email-masked]
> Subject: Re: [Diffserv] ToS, IPSec and Anti replay
>
>
> Hi Scott,
>       Can have an anti-replay mechanism per Diff. Code
> point basis that too on inner IP header's Diff. code
> point ( of course for security reason).
>       Hope this might answer the scenario you are
> mentioning.
>       Will appreciate your comments.
>
> Thanks,
> Praveen
> --- Brian E Carpenter <[email-masked]> wrote:
> > To be even more explicit: we expect to last-call the
> > tunnels
> > document any time now. Anyone who doesn't believe
> > that it
> > adequately responds to Scott Fanning's question
> > needs to say
> > so, so that we can close this issue permanently.
> >
> >   Brian Carpenter
> >   diffserv co-chair
> >
> > [email-masked] wrote:
> > >
> > > This is a real issue; please read
> > >         draft-ietf-diffserv-tunnels-01.txt
> > > and let me (and the list) know whether the
> > > material in Section 5 (and its subsections)
> > > addresses this adequately.
> > >
> > > Thanks,
> > > --David
> > >
> > >
> > ---------------------------------------------------
> > > David L. Black, Senior Technologist
> > > EMC Corporation, 42 South St., Hopkinton, MA
> > 01748
> > > +1 (508) 435-1000 x75140, FAX: +1 (508) 497-6909
> > > [email-masked]  Cellular: +1 (978) 394-7754
> > >
> > ---------------------------------------------------
> > >
> > > > -----Original Message-----
> > > > From: Scott Fanning [SMTP:[email-masked]]
> > > > Sent: Friday, June 23, 2000 11:46 AM
> > > > To:   [email-masked]
> > > > Subject:      [Diffserv] ToS, IPSec and Anti
> > replay
> > > >
> > > > All
> > > >
> > > > Thanks for the responses to my e-mail concerning
> > the above topic, but I
> > > > don't think I described the
> > > > problem completely so I will try again. Being
> > new to diff-serv, please
> > > > excuse my lack of correct terminology.
> > > >
> > > > In ESP and AH, there are sequence numbers that
> > are monotonicly
> > > > increasing. IPSec expects the packets to arrive
> > in order.
> > > >
> > > > Let DS = QoS Classification
> > > > Let GW = Gateway
> > > >
> > > >
> > <---------IPSec Tunnel------>
> > > > User A
> > > > User B<---->GW A /
> > DS<-------------->DS<---------->GW B<--->User D
> > > > User C
> > > >
> > > > User A, B and C all have different classes of
> > service applied to them, but
> > > > all on the same subnet.
> > > > GW A to GW B has a IPsec Tunnel that will tunnel
> > all packets across a
> > > > service providers network for that subnet to the
> > subnet on the other side
> > > > (GW B). Since all traffic goes through one
> > tunnel (Avery common Service
> > > > provider setup), each user with a different ToS
> > octet, when the diff-serve
> > > > device classifies the traffic on the other end,
> > it will go into separate
> > > > queues.
> > > >
> > > > As these queues will be serviced at different
> > times, the Seq Numbers to GW
> > > > B will be out of order and will be dropped.
> > > >
> > > > Has anyone seen, or experienced this. As I
> > stated before, anti-replay
> > > > can be turned off at the Receiver end, but it
> > would be better to
> > > > maintain the anti-replay service.
> > > >
> > > > Thanks
> > > > Scott
> > > >
> > > >
> > >
> > > _______________________________________________
> > > diffserv mailing list
> > > [email-masked]
> > > http://www1.ietf.org/mailman/listinfo/diffserv
> > > Archive: http://www-nrg.ee.lbl.gov/diff-serv-arch/
> >
> > --
> > - - - - - - - - - - - - - - - - - - - - - - - - - -
> > - - - - - - -
> > Brian E Carpenter
> > Program Director, Internet Standards & Technology,
> > IBM
> > On assignment for IBM at http://www.iCAIR.org
> > Attend INET 2000: http://www.isoc.org/inet2000
> > Non-IBM email: [email-masked]
> >
> > _______________________________________________
> > diffserv mailing list
> > [email-masked]
> > http://www1.ietf.org/mailman/listinfo/diffserv
> > Archive: http://www-nrg.ee.lbl.gov/diff-serv-arch/
> >
>
>
> __________________________________________________
> Do You Yahoo!?
> Get Yahoo! Mail - Free email you can access from anywhere!
> http://mail.yahoo.com/
>
> _______________________________________________
> diffserv mailing list
> [email-masked]
> http://www1.ietf.org/mailman/listinfo/diffserv
> Archive: http://www-nrg.ee.lbl.gov/diff-serv-arch/
>
>
>

_______________________________________________
diffserv mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/diffserv
Archive: http://www-nrg.ee.lbl.gov/diff-serv-arch/

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 03 Jul 2000 10:57:10 -0500

Scott,

Since a small box is hopefully only supporting a couple of diffserv traffic classes 
anyway, I'm not sure I see the scaling issue here.

  Brian