Subject: [Diffserv] questions regarding ipsec and diffserv

From: "Susie Riley" <[email-masked]>
Date: Mon, 30 Apr 2001 09:45:22 -0400

hi,

i've been reading up on vpns and ipsec, and i've got a question for the
diffserv group - if someone could shed some light in this matter i would
really appreciate it.

once a packet is encrypted according to ipsec, the tcp header is no longer
visible to any edge router that is trying to perform the diffserv function.
this means the diffserv classifier can only examine the ip header for
encrypted packets.  is this considered to be an issue for diffserv?  will
not the proliferation of ipsec on PCs (soon ipsec will become standard issue
on microsoft os)and PKI mean that eventually a large number of sessions over
the internet will be encrypted, thus challenging the usefulness of
diffserv's 5-tuple approach?

thanks in advance,
susie

******************************
Susie Kim Riley              *
Senior Consulting Engineer   *
ADCT                         *
Tel: 508-898-8840            *
******************************

_______________________________________________
diffserv mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/diffserv
Archive: http://www2.ietf.org/mail-archive/working-groups/diffserv/current/maillist.html

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 30 Apr 2001 10:10:03 -0500

Interaction with IPSEC is discussed in several diffserv RFCs 
(2474, 2475 and 2983). RFC 2983 is the most relevant to your
question.

The problem you raise is real enough, and it's why diffserv marking
by the originating host (i.e. before encryption) is a useful mechanism. 

   Brian Carpenter

-- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Brian E Carpenter 
Distinguished Engineer, Internet Standards & Technology, IBM 
On assignment for IBM at http://www.iCAIR.org 
Board Chairman, Internet Society http://www.isoc.org

---

From: "Susie Riley" <[email-masked]>
Date: Mon, 30 Apr 2001 11:40:06 -0400

yes, i understand about the diffserv marking by the originating host, but
devices at the edge may want to remark the packet because it wants to mark
the packets based on its policies, instead of 'trusting' the end station.

it seems the discussions in the rfcs are primarily relevant for tunnel
terminating edge devices - the scenario i am talking about is the case of a
home PC, hooking up to a provider.  yes, the pc will have to do the 'right'
marking, but the edge device at the provider may want to be able to verify
or reclassify based on the 5-tuple.  i guess what it comes down to in this
scenario is that provider edge devices will only be able to classify based
on the top level ip header for ipsec packets, and there's no way to get
around this limitation.  would you agree?  is this an issue the diffserv
group is going to explore further?

susie

-----Original Message-----
From: Brian E Carpenter [mailto:[email-masked]]
Sent: Monday, April 30, 2001 11:10 AM
To: Susie Riley
Cc: [email-masked]
Subject: Re: [Diffserv] questions regarding ipsec and diffserv

   Brian Carpenter

Susie Riley wrote:
> Archive:
http://www2.ietf.org/mail-archive/working-groups/diffserv/current/maillist.h
tml

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 30 Apr 2001 11:17:20 -0500

What you say is correct.

Actually there is nothing diffserv can do about it. It would need a change to
IPSEC (to avoid encrypting the transport header). Somehow that doesn't seem
very likely.

   Brian