Subject: RE: [Diffserv] DSCP handling in IPsec tunneling

From: [email-masked]
Date: Fri, 25 Aug 2000 18:21:39 -0400

And to be specific, having an exit endpoint pass
on possible DSCP changes made by an intermediate
node is currently not allowed by RFC 2401.  If you
are seriously considering doing this, please
think very carefully about the security
implications (e.g., what could an adversary
do to the network beyond the tunnel exit
via manipulating the DSCP values?).

> Whether this, among other combinations of juggling codepoint
> values between the headers at the input an exit of the tunnel
> is considered in the draft about to become an RFC:
> http://www.ietf.org/internet-drafts/draft-ietf-diffserv-tunnels-02.txt
> 
> 
> At 07:19 PM 08/24/2000 -0700, Jay Wang wrote:
> >
> >A question regarding the DSCP handling for IPsec tunneling. 
> >For an IPsec tunnel, at the entry endpoint, it is natural for the 
> >the outer IP header to assume the DSCP in the inner IP header. 
> >However, at the exit endpoint when we strip off the outer IP 
> >header, do we copy the DSCP in the outer IP header to the inner 
> >IP header too? That is, shall the exit endpoint pass on the possible 
> >DSCP change made by an intermediate DS node? 
> >
> >Does the WG have a particular stance on this or should it be totally a 
> >configurable policy as part of the IPsec tunnel setup?

--David
---------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 42 South St., Hopkinton, MA  01748
+1 (508) 435-1000 x75140, FAX: +1 (508) 497-6909
[email-masked]  Cellular: +1 (978) 394-7754
---------------------------------------------------

_______________________________________________
diffserv mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/diffserv
Archive: http://www-nrg.ee.lbl.gov/diff-serv-arch/

---

From: "Scott Fanning" <[email-masked]>
Date: Sat, 26 Aug 2000 14:39:23 -0700

I would not do this, and maybe go as far as stating that this SHOULD NOT be
done. If people are going to do this, then I would suggest that in the
tunnels draft, state the issues regarding this.

Scott

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf
> Of [email-masked]
> Sent: Friday, August 25, 2000 3:22 PM
> To: [email-masked]
> Subject: RE: [Diffserv] DSCP handling in IPsec tunneling
>
>