Subject: [Diffserv] DSCP handling in IPsec tunneling

From: Jay Wang <[email-masked]>
Date: Thu, 24 Aug 2000 19:19:22 -0700

Folks,

A question regarding the DSCP handling for IPsec tunneling.
For an IPsec tunnel, at the entry endpoint, it is natural for the
the outer IP header to assume the DSCP in the inner IP header. 
However, at the exit endpoint when we strip off the outer IP 
header, do we copy the DSCP in the outer IP header to the inner 
IP header too? That is, shall the exit endpoint pass on the possible 
DSCP change made by an intermediate DS node?

Does the WG have a particular stance on this or should it be totally a 
configurable policy as part of the IPsec tunnel setup?

Thanks.

- Jay Wang

---

From: John Schnizlein <[email-masked]>
Date: Thu, 24 Aug 2000 23:14:12 -0400

Whether this, among other combinations of juggling codepoint
values between the headers at the input an exit of the tunnel
is considered in the draft about to become an RFC:
http://www.ietf.org/internet-drafts/draft-ietf-diffserv-tunnels-02.txt

>configurable policy as part of the IPsec tunnel setup? 

_______________________________________________
diffserv mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/diffserv
Archive: http://www-nrg.ee.lbl.gov/diff-serv-arch/

---

From: [email-masked]
Date: Mon, 28 Aug 2000 09:40:39 -0400

The tunnels draft is informational and hence can't
use capitalized SHOULDs and MUSTs.  It does cover
this issue and points out that RFC 2401 says not
to pass on DSCP changes.  --David

---------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 42 South St., Hopkinton, MA  01748
+1 (508) 435-1000 x75140, FAX: +1 (508) 497-6909
[email-masked]  Cellular: +1 (978) 394-7754
---------------------------------------------------

> -----Original Message-----
> From:	Scott Fanning [SMTP:[email-masked]]
> Sent:	Saturday, August 26, 2000 5:39 PM
> To:	[email-masked]; [email-masked]
> Subject:	RE: [Diffserv] DSCP handling in IPsec tunneling
> 
> I would not do this, and maybe go as far as stating that this SHOULD NOT
> be
> done. If people are going to do this, then I would suggest that in the
> tunnels draft, state the issues regarding this.
> 
> Scott
> 
> > -----Original Message-----
> > From: [email-masked] [mailto:[email-masked]]On Behalf
> > Of [email-masked]
> > Sent: Friday, August 25, 2000 3:22 PM
> > To: [email-masked]
> > Subject: RE: [Diffserv] DSCP handling in IPsec tunneling
> >
> >
> > And to be specific, having an exit endpoint pass
> > on possible DSCP changes made by an intermediate
> > node is currently not allowed by RFC 2401.  If you
> > are seriously considering doing this, please
> > think very carefully about the security
> > implications (e.g., what could an adversary
> > do to the network beyond the tunnel exit
> > via manipulating the DSCP values?).
> >
> > --David
> > ---------------------------------------------------
> > David L. Black, Senior Technologist
> > EMC Corporation, 42 South St., Hopkinton, MA  01748
> > +1 (508) 435-1000 x75140, FAX: +1 (508) 497-6909
> > [email-masked]  Cellular: +1 (978) 394-7754
> > ---------------------------------------------------
> >
> >
> >