Subject: RE: [IPsec] Acquiring DSCP value(s)

From: Joy Latten <[email-masked]>
Date: Mon, 17 Sep 2007 15:02:11 -0500

>> > The same code that sets the DSCP on outbound packets can add data
>> > to your outbound-SA-selection routine.  As for the SAs themselves,
>> > their DSCP values are set locally by your implementation, whether
>> > it's a manual-SA program or a key management daemon.
>> 
>> Ok, thanks for clearing that up for me. 
>> I had read/scanned rfc 4306 but didn't see anything specific. 
>> It would be an attribute as far as IKE is concerned, right? But 
>> what transform type? Or does it matter?
>
>It's not an IKE attribute or transform type, because it's not
>negotiated in the protocol. 
>
>In other words: you can use IKE to create multiple IPsec SA pairs, 
>but it's not possible to negotiate which SA pair gets used for 
>which DSCP. That's left as a local matter: your implementation
>might send outbound packets with DSCP values A,B,C via one SA, 
>and all other DSCPs via a second one. Or you might create more 
>than two SA pairs. And so on...

Ok, I think I understand.
It is up to my local implementation to determine which
SAs get used with which DSCP values. 
So, when local implementation determines it needs SA for DSCP, 
the DSCP value is carried over in ACQUIRE and gets fed back into
an ADDed or UPDATEd SA by local key mgmt daemon on behalf 
of the ACQUIRE. Correct?

Thanks!!

Regards,
Joy

_______________________________________________
IPsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Dan McDonald <[email-masked]>
Date: Mon, 17 Sep 2007 17:10:15 -0400

On Mon, Sep 17, 2007 at 03:02:11PM -0500, Joy Latten wrote:
<SNIP!>
> SAs get used with which DSCP values. 

Yes!

> an ADDed or UPDATEd SA by local key mgmt daemon on behalf 

Yes!  That's what I was trying to say before.  Thanks to Pasi for the added
clarification.

Dan

---

From: Joy Latten <[email-masked]>
Date: Tue, 18 Sep 2007 12:35:09 -0500

> Yes!  That's what I was trying to say before.  Thanks to Pasi for the added
:-)
Thanks to you both for clearing that up for me.
Now I can implement. 

regards,
Joy