Subject: [IPsec] Traffic Visibility Future

From: Jack Kohn <[email-masked]>
Date: Fri, 8 Jan 2010 05:36:24 +0530

Folks,

Some questions.

o In a steady state, where we are using WESP only for ESP-NULL, what
should a middle box do when it sees  ESP traffic, besides
hyperventilating and throwing up? Should it run heuristics (dang! no)
or should it simply assume that the packet is encrypted and do
whatever the local policy dictates it to do for all encrypted packets?
I would guess that it'll be the latter as most middle boxes will NOT
run heuristics. Then going forward, should we recommend obsoleting the
use of NULL cipher with ESP, as thats the easiest way to get folks off
using ESP-NULL.

o Are we going to approach the other WGs to starting using WESP
wherever they propose to use ESP-NULL? Is that the plan?

Jack

---

From: "Dan Harkins" <[email-masked]>
Date: Thu, 7 Jan 2010 16:21:19 -0800 (PST)

Hi Jack,

> use of NULL cipher with ESP, as thats the easiest way to get folks off

  No.

> wherever they propose to use ESP-NULL? Is that the plan?

  I sure hope not!

  Dan.

---

From: Melinda Shore <[email-masked]>
Date: Thu, 7 Jan 2010 15:25:36 -0900

On Jan 7, 2010, at 3:06 PM, Jack Kohn wrote:
> hyperventilating and throwing up?

How would that information be used here?  Do you want
to specify middlebox behavior?

In my experience in some environments network
administrators would like to prevent encrypted traffic
on the wire because they want to inspect packet contents.
I'm trying to think of requirements for doing that other
than providing the ability to flag the packet as
encrypted or not (let's assume that the presence or
absence of other encryption protocols is out-of-scope,
since it is out-of-scope) and can't see anything
obvious.

Melinda

---

From: Jack Kohn <[email-masked]>
Date: Fri, 8 Jan 2010 06:09:26 +0530

>> use of NULL cipher with ESP, as thats the easiest way to get folks off

Interesting. Then how to do you propose to get people started off with
using WESP or the AH-lite?

>> wherever they propose to use ESP-NULL? Is that the plan?

Curious. Why not?

---

From: Jack Kohn <[email-masked]>
Date: Fri, 8 Jan 2010 06:15:07 +0530

> to specify middlebox behavior?

No, i dont plan anything this ambitious.

I am just trying to understand what a WESP powered middle box thats
interested in deep inspecting packets, should do when it sees a native
ESP packet. Should it make an attempt to parse it based on heuristics
(which i completely resent) or should it treat the packet as encrypted
and do whatever the local policy dictates?

> on the wire because they want to inspect packet contents.

Ok, so in such cases, WESP capable middle boxes would probably drop
all ESP (including ESP-NULL) traffic.

> I'm trying to think of requirements for doing that other

.. doing what? I am sorry i could not follow your following statements.

Jack

---

From: Melinda Shore <[email-masked]>
Date: Thu, 7 Jan 2010 15:51:04 -0900

> and do whatever the local policy dictates?

It seems to me that any discussion of what the middlebox
"should" do is not just out-of-scope, it's very very very
very very out-of-scope.

>> .. doing what? I am sorry i could not follow your following  

Sorry - writing while groggy.  Basically, if there
are additional requirements for being able to
detect encrypted packets that would require some
action on the part of ipsecme, I can't think of them
off the top of my head.

Melinda

---

From: "Dan Harkins" <[email-masked]>
Date: Thu, 7 Jan 2010 16:59:39 -0800 (PST)

> using WESP or the AH-lite?

  As I have been saying, if you have the problem that WESP claims to
be solving you prohibit ESP-null by local policy.

>>> wherever they propose to use ESP-NULL? Is that the plan?

  Because it's unnecessary bloat that another group may not have any
use for. ESP-null could be used, for instance, to protect packets in an
EGP routing protocol. There is no need for WESP in such an environment.
We should not try to get people to use a protocol simply because the
IT department in some enterprise somewhere likes it.

  Dan.

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 7 Jan 2010 19:03:14 -0600

> "should" do is not just out-of-scope, it's very very very

Yes, but it's useful to know what they could possibly do.  If a
middlebox wants to drop all encrypted IPsec traffic then it needs to
know if it's encrypted.  Knowing WESP -> ESP-null, ESP -> unknown, is
sufficient.

Anyone who might want to configure middle boxes to drop ESP-!null is not
really going to be helped by having a WESP "encrypted bit" -- either way
they'll have to have a flag day when they impose this policy.

Nico
--

---

From: Jack Kohn <[email-masked]>
Date: Fri, 8 Jan 2010 07:39:47 +0530

> know if it's encrypted.  Knowing WESP -> ESP-null, ESP -> unknown, is

Yup, and this is what i was alluding to. All middle boxes may not want
to drop all encrypted traffic, which is why i said that such boxes
must do what their local policy dictates.

If the local policy dictates, marking all encrypted packets as low
priority, then it must mark all ESP traffic as low prio, as it has no
way of knowing whether the incoming traffic is ESP or ESP-NULL.

This is what i had meant in my original mail.

> they'll have to have a flag day when they impose this policy.

Yes, if the intent is to drop all encrypted packets.

However, it can help, if the intent is to do separate processing for
null and encrypted packets. In case of vanilla ESP, we will also have
some false negatives, which may not be desired.

Jack

---

From: "Bhatia, Manav (Manav)" <[email-masked]>
Date: Fri, 8 Jan 2010 07:45:32 +0530

Dan,

[clipped]
 
> EGP routing protocol. There is no need for WESP in such an 

EGP routing protocols, by definition and design, will traverse multiple autonomous systems, and there could very well be a policy on the edge of one such AS that could deny entry to any traffic that it doesn't recognize. 

Using WESP will clearly help in such cases.

Cheers, Manav

---

From: "Dan Harkins" <[email-masked]>
Date: Thu, 7 Jan 2010 21:11:51 -0800 (PST)

I would be very much interested in a real-world example instead
of hypotheticals. What service provider is asking for WESP?

  Dan.

On Thu, January 7, 2010 6:15 pm, Bhatia, Manav (Manav) wrote:
> EGP routing protocols, by definition and design, will traverse multiple
> autonomous systems, and there could very well be a policy on the edge of
> one such AS that could deny entry to any traffic that it doesn't
> recognize.
>
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec
>

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 7 Jan 2010 23:49:59 -0600

> This is what i had meant in my original mail.

That's what I thought.

> some false negatives, which may not be desired.

Yeah, but if the action to be taken is anything other than "drop" then
the false positives do little harm.  Also, anything QoS related should
really happen outside ESP anyways.  What are we left with?  Auditing/
logging based on deep inspection?  But then you're back to the question
of just how paranoid one can get.  If you trust the end-points then you
might as well trust them to use WESP and ESP-!null as appropriate, else
you can't win.  This is why I don't see the need for WESP to wrap
ESP-!null.

Nico
--

---

From: "Bhatia, Manav (Manav)" <[email-masked]>
Date: Fri, 8 Jan 2010 17:05:19 +0530

I never said that there are service providers clamouring for WESP. 

You brought up a point about EGP routing protocols, and I just replied to that.

Cheers, Manav 

> -----Original Message-----
> From: Dan Harkins [mailto:[email-masked]] 
> Sent: Friday, January 08, 2010 10.42 AM
> To: Bhatia, Manav (Manav)
> Cc: Dan Harkins; Jack Kohn; [email-masked]
> Subject: Re: [IPsec] Traffic Visibility Future
> 
>

---

From: "Joseph Tardo" <[email-masked]>
Date: Fri, 8 Jan 2010 11:14:06 -0800

-----Original Message-----
<snip>
Also, anything QoS related should really happen outside ESP anyways.  
</snip>
Nico
--

In an ideal world maybe. Sometimes the netwwork needs to mark traffic at the edge switch but doesn't 'trust' the endpoint to do it. So typically it would be done with policy rules.

Thanks,
--Joe

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 8 Jan 2010 13:20:06 -0600

On Fri, Jan 08, 2010 at 11:14:06AM -0800, Joseph Tardo wrote:
> In an ideal world maybe. Sometimes the netwwork needs to mark traffic
> at the edge switch but doesn't 'trust' the endpoint to do it. So
> typically it would be done with policy rules.

We're talking about making changes to the end nodes anyways, so why not
make them handle QoS correctly?

---

From: "Bhatia, Manav (Manav)" <[email-masked]>
Date: Sat, 9 Jan 2010 05:38:15 +0530

> make them handle QoS correctly?

QoS remarking is done by the service provider based on various factors (the SLA negotiated with the customer), and it cannot simply trust what it receives from the customer (the end nodes in this case).

Cheers, Manav