Subject: RE: [Ipsec] draft-ietf-ipsec-rfc2401bis-05.txt

From: "Vishwas Manral" <[email-masked]>
Date: Tue, 1 Feb 2005 09:18:31 -0800

Hi Steve,
 
> So, what you are suggesting is that if the receiver is in a different
> diffserv domain, then it should change the DSCP value apropos the
> receiver's domain, right? How would this be done, in practice, e.g.,
> would one require a table to map between the DSCP values for each
> domain? I'm tempted to say this should be done outside the IPsec
> context, by the receiver, so that this is not another IPsec
> configuration item, e.g., part of the SPD.  We could  insert a note
> to that effect if folks agree.
Yes that is what I am suggesting, as a DSCP value in one domain may not make 
sense in another domain at all (so leaving the text as is is not right I think). 
 
There could be alternatives. If it was normal IP-in-IP tunnelling we could as well 
use the outer header DSCP and ECN values, which would be the best case.
 
However for IPSec from the hardware forwarding point of view it would be best if the
 inner header already had the right value DSCP value, but that would mean adding changes
in the IKE draft. 
 
So I think the alternative you agree to is the best. Anyone else?
 
Thanks,
Vishwas
________________________________

From: Stephen Kent [mailto:[email-masked]]
Sent: Tue 2/1/2005 8:11 AM
To: Vishwas Manral
Cc: [email-masked]; [email-masked]
Subject: RE: [Ipsec] draft-ietf-ipsec-rfc2401bis-05.txt

At 3:41 AM -0800 2/1/05, Vishwas Manral wrote:
>Hi Steve/ Karen,
>
>After the discussion with Brian (and checking rfc2983), I think the
>following minor change can be added in section 5.1.2.1 and 5.1.2.2, for
>the Inner Header at decapsulator: -
>
>DSCP - constructed (9)
>
>9. If the DSCP values changes a diffserv domain, the diffserv traffic
>conditioning SHOULD be done in order to ensure that traffic exiting the
>node is compatible with the egress node's diffserv domain.

So, what you are suggesting is that if the receiver is in a different
diffserv domain, then it should change the DSCP value apropos the
receiver's domain, right? How would this be done, in practice, e.g.,
would one require a table to map between the DSCP values for each
domain? I'm tempted to say this should be done outside the IPsec
context, by the receiver, so that this is not another IPsec
configuration item, e.g., part of the SPD.  We could  insert a note
to that effect if folks agree.

>Regarding the ECN part, I think I understand. The values ECT (0) and ECT
>(1) can be there as is and CE is copied to make sure that in case of
>congestion it is signaled to the endpoint. However this can lead to an
>intermediate router changing the value maliciously to CE (but packets
>could as well have been dropped by the intermediate router). I hope my
>understanding is right here?

The ECN value is copied from the outer header to the inner header as
described in the text, based on analysis David Black did a few years
ago, and codified in RFC 2983. The notion is that a malicious router
could do other evil things to packets comparable to what it can
effect via changes to the ECN value, so it makes sense to copy the
bit as directed, to support ECN functionality.

Steve

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec