Subject: RE: [Diffserv] questions regarding ipsec and diffserv

From: "Greene, Jeremy" <[email-masked]>
Date: Wed, 2 May 2001 16:46:12 -0400

I thought Susie was focusing on the end-customer to end-customer case
(probably IPSEC Transport mode?) going through  one ISP and how the flows
entered the ISP's DS domain. 

It seems worth while to separate that question from the 'multiple-isp'
problem.

Btw, the ISP peering problem exists for edge created ipsec tunnels too.

Jeremy

> -----Original Message-----
> From: Brian E Carpenter [mailto:[email-masked]]
> Sent: Wednesday, May 02, 2001 4:09 PM
> To: Greene, Jeremy
> Cc: Fred Baker; Susie Riley; [email-masked]
> Subject: Re: [Diffserv] questions regarding ipsec and diffserv
> 
> 
> Because DSCPs are mappable, different ISPs may attach 
> different meanings
> to the same DSCP (unfortunately). But I think we're getting a 
> bit out of scope
> here.
> 
>    Brian
> 
> "Greene, Jeremy" wrote:
> > 
> > Why does the ISP care? In the end, the ISP will only honor 
> the various DSCPs
> > according to the (paid for) SLA. It's a local matter to 
> make sure that the
> > users are marking packets in the proper way to use what's 
> paid for (in the
> > sla). And if it's done wrong, they'll probably loose packets.
> > 
> > If the customer wants the ISP to classify packets with 
> other than the DSCP,
> > then they can't be encrypted.
> > 
> > The bigger issue (Brian alluded to?) is going through 
> multiple  ISPs... but
> > this is only one of the many problems in that case.
> > 
> > Jeremy
> > 
> > > -----Original Message-----
> > > From: Brian E Carpenter [mailto:[email-masked]]
> > > Sent: Wednesday, May 02, 2001 12:50 PM
> > > To: Fred Baker
> > > Cc: Susie Riley; [email-masked]
> > > Subject: Re: [Diffserv] questions regarding ipsec and diffserv
> > >
> > >
> > > Fred Baker wrote:
> > > >
> > > > At 10:10 AM 4/30/2001 -0500, Brian E Carpenter wrote:
> > > > >The problem you raise is real enough, and it's why 
> diffserv marking
> > > > >by the originating host (i.e. before encryption) is a
> > > useful mechanism.
> > > >
> > > > it is also one of the good reasons for putting the DSCP in
> > > the IP header.
> > >
> > > Of course; but the question is whether a downstream ISP chooses to
> > > trust that DSCP without being able to re-classify the packet.
> > >
> > >    Brian
> 

_______________________________________________
diffserv mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/diffserv
Archive: http://www2.ietf.org/mail-archive/working-groups/diffserv/current/maillist.html

---

From: demir <[email-masked]>
Date: Wed, 2 May 2001 14:31:54 -0700 (PDT)

I fail to see the higher level difference between one-ISP and multiple
ISPs. The whole depend on the "trust-issue". If I "trust" my ISP, then I
should trust the rest ISPs that my traffic passing through (in
multiple-ISPs case) because my ISP becomes a customer of the downstream
ISP. If I don't, then the rest is "untrusted". IPsec is an end-to-end
security protocol and end-points are the "trust" points. 

Alper K. Demir