Subject: [IPsec] rfc 4301 and multiple SAs

From: Joy Latten <[email-masked]>
Date: Tue, 02 Oct 2007 12:49:59 -0500

I would just like some verification about multiple SAs
with same selector values requirement.

It appears establishment and maintenance of multiple SAs
with the same selector values is a MUST in order
to support QoS/DSCP.

If an implementation decides to route all QoS traffic
over the same SA pair, I assumed it would not eliminate 
the need to support multiple SAs with same selectors. 
Because, local implementation must be able to respond to and 
establish SAs with a remote who does want multiple SAs
with same selectors because remote implementation does 
route traffic over several SAs. Right? 

Regards,
Joy Latten

_______________________________________________
IPsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: ns srinivasa murthy <[email-masked]>
Date: Wed, 03 Oct 2007 13:29:49 +0530

You are right.We at Intoto allow creation of
multiple SAs with the same selectors(even if DSCP is not selected).

But the remote implementation (that does route traffic over several SAs)
shall not check DSCP value in the IP Header to find out whether the 
packet is received on appropritae SA or not.It should allow traffic 
on any one of the SA's created by the same selectors.It shall be 
selective of SA's only for outbound traffic.
We at Intoto support this also.

-ns murthy
  Intoto

>route traffic over several SAs. Right?

********************************************************************************
This email message (including any attachments) is for the sole use of the intended recipient(s) 
and may contain confidential, proprietary and privileged information. Any unauthorized review, 
use, disclosure or distribution is prohibited. If you are not the intended recipient, 
please immediately notify the sender by reply email and destroy all copies of the original message. 
Thank you.
 
Intoto Inc.

---

From: Karen Seo <[email-masked]>
Date: Wed, 3 Oct 2007 10:45:20 -0400

Hello,

Yes, it's a MUST for the IPsec implementation to support multiple SAs 
with the same selectors for support of QoS.  See sections 4.1 (pages 
13 and 14) and 7.2 (page 68) for further info.

Karen

---

From: Stephen Kent <[email-masked]>
Date: Tue, 23 Oct 2007 03:21:16 -0400

>route traffic over several SAs. Right?

right.

Steve