Subject: [PCN] Can tunnels really terminate in the interior of a PCN domain?

From: Tom Taylor <[email-masked]>
Date: Thu, 12 May 2011 11:41:55 -0400

A primary assumption behind the use of PCN, one which I don't recall 
seeing stated in so many words, is that it applies only to traffic 
transiting the domain. That is, it does not apply to traffic addressed 
to some server inside the network, unless you draw a boundary around any 
such server and say that PCN-nodes connected to it are PCN-edge-nodes.

That said, it seems to me that by definition it is impossible to 
terminate a tunnel in the interior of a PCN-domain. Am I wrong?

Tom

---

From: Michael Menth <[email-masked]>
Date: Thu, 12 May 2011 18:20:03 +0200

Hi Tom,

I think you are right. It is important that all PCN traffic is delivered 
to an egress node; otherwise PCN marks cannot be captured and taken into 
account for feedback.

Regards,

     Michael

Am 12.05.2011 17:41, schrieb Tom Taylor:
> to some server inside the network, unless you draw a boundary around 
> any such server and say that PCN-nodes connected to it are 
> PCN-edge-nodes.
>
> _______________________________________________
> PCN mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pcn

-- 
Prof. Dr. habil. Michael Menth
University of Tuebingen
Faculty of Science
Department of Computer Science
Chair of Communication Networks
Sand 13, 72076 Tuebingen, Germany
phone: (+49)-7071/29-70505
fax: (+49)-7071/29-5220
mailto:[email-masked]
http://www-kn.informatik.uni-tuebingen.de

---

From: "Toby Moncaster" <[email-masked]>
Date: Thu, 12 May 2011 17:45:08 +0100

Tom,

I assume you're talking of tunnels that straddle the PCN-domain (start
outside and end inside). I've often puzzled about such things.

There is one very small corner case I can think of:

If non-PCN traffic within a tunnel arrives at a PCN-ingress and shares the
same DSCP it might get put into the not-PCN codepoint. That tunnel could
theoretically terminate within the PCN-domain, but it shouldn't affect
things. There is a really obscure possibility that something broken outside
the PCN domain puts some traffic that should be PCN within a tunnel bound
for a node within the PCN domain. I really can't tell what would happen
then!

There is also the case of tunnels that start and end within the
PCN-domain... Those should be OK as long as they use sensible tunnelling
rules (such that marks are copied down on decapsulation).

There is one argument that says having any traffic within the PCN-capable
DSCP destined for a PCN-interior node is impossible since by definition that
makes it into a PCN-egress node. I think that may be what you're driving at?

Toby

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Michael Menth
> Sent: 12 May 2011 17:20
> To: Tom Taylor
> Cc: pcn
> Subject: Re: [PCN] Can tunnels really terminate in the interior of a
> PCN domain?
> 
> Hi Tom,
>

---

From: Tom Taylor <[email-masked]>
Date: Thu, 12 May 2011 13:00:54 -0400

FYI my query related to operational considerations.

> outside and end inside). I've often puzzled about such things.
[PTT] Yes

....

> makes it into a PCN-egress node. I think that may be what you're driving at?
[PTT] Yes again.

> Toby
...

---

From: <[email-masked]>
Date: Fri, 13 May 2011 10:59:42 +0100

I spent a bit of time puzzling about such tunnels during PCN-architecture days. I remember we had some discussion with David Black, and he was happy with the approach written in rfc5559. Reading it again, it seems to be saying
In case (1), effectively treat it as having some PCN-ingress-node functionality at the tunnel egress;
In case (2), make sure that when it's eventually decapsulated, nothing in that distant network will be confused.

phil

http://tools.ietf.org/html/rfc5559#section-4.7

<<
  Potential issues arise for a "partially PCN-capable tunnel", ie,
   where only one tunnel endpoint is in the PCN-domain:

   1.  The tunnel originates outside a PCN-domain and ends inside it.
       If the packet arrives at the tunnel ingress with the same
       encoding as used within the PCN-domain to indicate PCN-marking,
       then this could lead the PCN-egress-node to falsely measure pre-
       congestion.

   2.  The tunnel originates inside a PCN-domain and ends outside it.
       If the packet arrives at the tunnel ingress already PCN-marked,
       then it will still have the same encoding when it's decapsulated,
       which could potentially confuse nodes beyond the tunnel egress.

   In line with the solution for partially capable Diffserv tunnels in
   [RFC2983], the following rules are applied:

   o  For case (1), the tunnel egress node clears any PCN-marking on the
      inner header.  This rule is applied before the "copy on
      decapsulation" rule above.

   o  For case (2), the tunnel ingress node clears any PCN-marking on
      the inner header.  This rule is applied after the "copy on
      encapsulation" rule above.

   Note that the above implies that one has to know, or determine, the
   characteristics of the other end of the tunnel as part of
   establishing it.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Tom Taylor
Sent: 12 May 2011 18:01
To: Toby Moncaster
Cc: 'pcn'
Subject: Re: [PCN] Can tunnels really terminate in the interior of a PCN domain?

[PTT] Yes

....

[PTT] Yes again.

...

---

From: "Lee, Richard FTC" <[email-masked]>
Date: Fri, 13 May 2011 09:21:24 -0400

To all;

I deal with strategic design for the enterprise

A thought --
I see this as a handoff problem between 2 domains
If the ingress node is in 1 PCN domain and the destination/egress node is in another PCN domain; you are assuming a level of trust that may not exist
Wouldn't it be better to deal with it as a perimeter problem

Ingress PCN-1 domain traverses across PCN-1
At the perimeter between PCN-1 and PCN-2, the egress node for the PCN-1 domain marks the packets for PCN handling

PCN-2 domain may or may not honor the marking
If the PCN-2 domain acts on the marking; PCN-2 perimeter ingress marks PCN for the PCN-2 domain
The destination in the PCN-2 domain is the PCN-2 egress and appropriate responses are sent within PCN-2, from PCN-2 to PCN-1 and within PCN-1 domains

If the PCN-2 domain does not act on the marking no response is sent 

Rich 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Friday, May 13, 2011 6:00 AM
To: [email-masked]; [email-masked]
Cc: [email-masked]
Subject: Re: [PCN] Can tunnels really terminate in the interior of a PCN domain?

phil

<<

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Tom Taylor
Sent: 12 May 2011 18:01
To: Toby Moncaster
Cc: 'pcn'
Subject: Re: [PCN] Can tunnels really terminate in the interior of a PCN domain?

[PTT] Yes

....

[PTT] Yes again.

...

---

From: <[email-masked]>
Date: Mon, 16 May 2011 13:17:09 +0100

I'm sure you're right that it can be considered as a perimeter problem.

when the group first started, we were thinking about the use case where there are 2 adjacent PCN-domains. The idea was to apply some CONEX-like technology to this scenario, so as to enable PCN-domains to be interconnected, even when the domains didn't trust each other. In order to simplify the WG's scope, we decided to put this out of scope (well, initial scope, but I don't think people want to re-charter)
Conex now has a WG, http://tools.ietf.org/wg/conex/ 

If i remember right, in RFC5559 we were thinking about tunnel from PCN-domain to non-PCN-domain (or vice-versa), rather than from one PCN-domain to another PCN-domain.

Best wishes
Phil

-----Original Message-----
From: Lee, Richard FTC [mailto:[email-masked]] 
Sent: 13 May 2011 14:21
To: Eardley,PL,Philip,DES8 R; [email-masked]; [email-masked]
Cc: [email-masked]
Subject: RE: [PCN] Can tunnels really terminate in the interior of a PCN domain?

To all;

A thought --

Rich 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Friday, May 13, 2011 6:00 AM
To: [email-masked]; [email-masked]
Cc: [email-masked]
Subject: Re: [PCN] Can tunnels really terminate in the interior of a PCN domain?

phil

<<

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Tom Taylor
Sent: 12 May 2011 18:01
To: Toby Moncaster
Cc: 'pcn'
Subject: Re: [PCN] Can tunnels really terminate in the interior of a PCN domain?

[PTT] Yes

....

[PTT] Yes again.

...