Subject: RE: [Diffserv] Managed VPN's

From: "McMillan, Paul" <[email-masked]>
Date: Thu, 3 May 2001 06:58:34 -0700

Sue,

Yeah I did misconstrue your statement. Central office to me does refer to a
service provider central office.  The Shasta Box that I am familiar with
normally resides at a service provider POP or behind a DSLAM or CMTS.  In
this environment, a customer could run unencrypted to the IP services switch
(Shasta or Springtide, or tachion or Unisphere ERX) where the appropriate
QOS could be applied and then subsequently encrypted. I have to confess that
I am still getting up to speed on the Diffserv architecture and how it would
be applied in a service provider environment.  It seems that we would have
an issue maintaining QOS across the service provider network once encryption
takes place.  I also dont know how many customer will want to have their
traffic in the clear in the case of a DSL or Cable environment.  I have not
seen an application where the SHASTA device actually sits on a customer
premise.

				Paul

-----Original Message-----
From: Susie Riley [mailto:[email-masked]]
Sent: Thursday, May 03, 2001 8:52 AM
To: Brian E Carpenter; McMillan, Paul
Cc: [email-masked]
Subject: RE: [Diffserv] Managed VPN's

paul - i'm not sure but you might have misconstrued one of my earlier
messages - about having the box at the central office.  my 'central office'
referred to the corporate headquarters where the vpn is trying to
terminate - not the isp's central office.

generally i think there are several types of vpns.  some that require
equipment at the customer premise, and some that do not.  i think the
example with the shasta box, etc. etc., falls under the category of the
second scenario.

brian, i can write up a summary of the issue.  i want to keep it somewhat
contained so i will not go into inter-domain stuff.  when do you need it by?

susie

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf
Of Brian E Carpenter
Sent: Wednesday, May 02, 2001 5:55 PM
To: McMillan, Paul
Cc: [email-masked]'
Subject: Re: [Diffserv] Managed VPN's

Probably, but this and the general IPSEC issue is not one the diffserv WG
can solve. We will bring this point up with the Area Directors if someone
writes
a collected summary of the issue. But if nobody writes a summary, this
discussion
will go nowhere.

   Brian

"McMillan, Paul" wrote:
>
> Most Managed VPN services that we have seen entail placing a VPN box
> directly on the customer premise and not at a central office.  Even remote
> users/telecommuters typically have a VPN Client running on their
> workstation. This would present an issue I believe when trying to
establish
> the appropriate QOS through the service provider network even if it
remains
> on one providers IP backbone.
>
>  Regards
> Paul McMillan
> Solutions Architect
> Siemens Enterprise Networks
> Penn-Jersey Region
> RNET 590-3527
> Outside (610)-660-3527
>
> _______________________________________________
> diffserv mailing list
> [email-masked]
> http://www1.ietf.org/mailman/listinfo/diffserv
> Archive:
http://www2.ietf.org/mail-archive/working-groups/diffserv/current/maillist.h
tml

--
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Brian E Carpenter
Distinguished Engineer, Internet Standards & Technology, IBM
On assignment for IBM at http://www.iCAIR.org
Board Chairman, Internet Society http://www.isoc.org

_______________________________________________
diffserv mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/diffserv
Archive:
http://www2.ietf.org/mail-archive/working-groups/diffserv/current/maillist.h
tml

_______________________________________________
diffserv mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/diffserv
Archive: http://www2.ietf.org/mail-archive/working-groups/diffserv/current/maillist.html

---

From: "Susie Riley" <[email-masked]>
Date: Thu, 3 May 2001 10:56:10 -0400

i think most customers would probably also want some kind of protection
between the customer premise and the service provider/dslam/cmts.  i know
for cmts they are talking about providing encryption at the lower layers.
as for shasta boxes - no i don't think they would sit on a customer premise
either.

i think there's work going on in the ppvpn group related to some of these
issues (security, vpns, etc).  i think some of these discussion belong there
more so than here.

i'm trying to raise the awareness of the issues surrounding ipsec and
diffserv at the edge in the case of ipsec originating and terminating at a
non-provider's equipment (the same problem exists regardless of whether it's
transport or tunnel mode).

i think in the case of provider provisioned vpns (those managed by the
provider) where the vpn equipment sits at the isp the issues might be
minimal - since most likely the packet will arrive from the customer premise
either in the clear or through a locally terminated secure tunnel.

susie

-----Original Message-----
From: McMillan, Paul [mailto:[email-masked]]
Sent: Thursday, May 03, 2001 9:59 AM
To: 'Susie Riley'
Cc: [email-masked]'
Subject: RE: [Diffserv] Managed VPN's

Sue,

				Paul

-----Original Message-----
From: Susie Riley [mailto:[email-masked]]
Sent: Thursday, May 03, 2001 8:52 AM
To: Brian E Carpenter; McMillan, Paul
Cc: [email-masked]
Subject: RE: [Diffserv] Managed VPN's

susie

-----Original Message-----

   Brian

establish
remains